{ "Event": { "published": true, "date": "2023-02-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-08", "timestamp": 1675900981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "226a32be-7d60-46fd-a892-5010759b8153", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684cfe2d-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885643, "uuid": "a23ecfc8-398c-40e7-aac0-47976e024908", "comment": "Malware payload", "value": "76eabd1a4cb29345dc7b027c977c04a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885643, "uuid": "c6212084-17c0-44d7-b7c4-334a9caf1bb4", "comment": "Malware payload", "value": "001471dc1fe33c88596ca8973ae81cf4f9c80d517e98807e6a57c15c80a828b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885643, "uuid": "9aaa38d6-3d7c-49fb-9c80-71ccb24c48a2", "comment": "Malware payload", "value": "c3a4df446e19dd1969cbcccd12e608fe027b78a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885643, "uuid": "b73cb236-5e92-49a9-b7d1-84825e0c4900", "comment": "Malware payload", "value": "378185750f9d85ecf2a70e8d09405b3b1b165ecbd2439f70c27a0b28e473b746699561905cb6f7061d76b5ad1272813e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885643, "uuid": "f5d49a75-fdba-4deb-b922-868336767545", "value": "T1E96307CC4789C48F5F8C6D03AA795E8651A683639BC93383B72CFE4D1BD669BC10C499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885643, "uuid": "419f1bfb-3ad1-4a3b-abc1-7e4da20e3a43", "value": "1536:c1cEnLEnLEnLEnLEnnEnLEnLEnLEnLEnnEnLEnLEnLEnLEnnuEnLEnLEnLEnLEns:UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885643, "uuid": "39912e66-1fb0-4961-8bb8-67fb62f69cb4", "value": 70712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885643, "uuid": "3cef7b06-9bd5-4094-b115-3e453af0525c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885643, "uuid": "96200a8d-4432-475d-a9e6-8f82d7fb002c", "value": "thomas.hannett-Fax-id__Received_02page(s).htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716d1a3e-a7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675869338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869338, "uuid": "2fe90b8b-8675-4e6c-9ab5-458af6cd9d3b", "comment": "Malware payload (GCleaner)", "value": "54a2a5f7707a74d071acc97209d71301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869338, "uuid": "e7a80d8f-ca6b-458f-b9b5-81b28f37569e", "comment": "Malware payload (GCleaner)", "value": "007bcfad2069bb9072d9367b2a643fe5d392b1e755104128b7bbec24ab44c4f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869338, "uuid": "bd2d8674-0a0e-4a37-88c0-6aa145ee5009", "comment": "Malware payload (GCleaner)", "value": "2d5c9ffb8b72dfd4ae6f00d53ffed5bede855e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869338, "uuid": "6d63ed96-3bfc-47f6-ba2d-263d3c09a65c", "comment": "Malware payload (GCleaner)", "value": "33494980046e6b23c35e1a5717432607d11bd030316da951275b091922a886922ac554a4b2939f976a787fca16d220a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869338, "uuid": "81e1ab29-bc66-4594-8065-093030d41761", "value": "T17FC5127D7115D86DC2D0BEB48C2A98E71CDB6DE3E8D4A06270CD7F3F527A2885A0A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869338, "uuid": "5ef7f55f-e1cf-4db0-adf8-932a37516e3d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869338, "uuid": "27aeb93c-2ac6-4c51-b9aa-6c8ff3259ece", "value": "49152:rdHzwimce+AqOv7WdJqcjmeyEy1M6WfgW7281kcTOJRlpns4jeLrySLCgv2MR:JHVXiSquByxm67W7hkZc4ky6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869338, "uuid": "331555a8-c4a6-438b-91ae-e527bb61b321", "value": 2738286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869338, "uuid": "f2c86df3-07bc-4c0b-b300-86d29e166dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869338, "uuid": "f4e8ef99-53be-46f7-b616-fd58184c346a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbcb8b9-a799-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675851269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851269, "uuid": "1404b4c5-8fc5-4315-861a-1964ed918407", "comment": "Malware payload (Amadey)", "value": "5407b815795cf8d98cf44a36fcd28c7a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851269, "uuid": "64b34f67-ef87-4123-b796-aae1acb85753", "comment": "Malware payload (Amadey)", "value": "00bbcf6492c575d0affed73182156644a74d5ef84d701c818972f880dac13360", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851269, "uuid": "6154855c-3bb6-4767-a590-fff549f6d171", "comment": "Malware payload (Amadey)", "value": "6beab82c8b45c07b12b0d9210413f9ffe525b5a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851269, "uuid": "724b0654-ded2-415c-ae35-584f9cda9e0d", "comment": "Malware payload (Amadey)", "value": "1ba60b31357f6fe20258d06c54fac21864b8c311f91cbc822a31c117f167331980e0ef6ffd3295d2b078051c6371a557", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851269, "uuid": "fa5b3678-fa10-48a3-a6c3-70fab010afd7", "value": "T157C40217E6D95123D4B20B7049F613C31A3ABE665B38839E254F6D5E0CB32A0F63572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851269, "uuid": "d40397e7-7f79-4e31-af49-74d37c2408b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851269, "uuid": "daef15dd-d42d-4f3a-860b-cf0ce3ee3298", "value": "12288:ZMroy90duFG1zKOSKnkSu9PxzFeJSCsedNIbwouU6/:ty8u+KbPveSZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675851269, "uuid": "b7bcc031-da28-4468-b585-e113fea04fe4", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675851269, "uuid": "5c4a7c19-9af7-46cb-8228-be008b623fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851269, "uuid": "113daf2c-56bc-49cc-95ac-ce35984d0721", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76e6363-a7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675875468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875468, "uuid": "968b88cf-5a5c-44a1-8c20-e08506bf2181", "comment": "Malware payload (Amadey)", "value": "dc8fee96d0387c87f8a0c995c3314472", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875468, "uuid": "b72f4584-e662-42d8-9623-03e624782b8d", "comment": "Malware payload (Amadey)", "value": "00e9e07acdef7b68c76869ae596854c13d2a6e71796337fbb5643bad2b3d825a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875468, "uuid": "5506f533-2efc-4db4-aaf2-a5249efd8670", "comment": "Malware payload (Amadey)", "value": "a855822e3c5f4c19c3ee4468f2f009c0309fc7e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875468, "uuid": "c3fc030e-9a00-444d-8dbe-8c234c16e3b6", "comment": "Malware payload (Amadey)", "value": "57330a77d0798280b2748568b7e6853595f72738b34347863adbbdf2a0d1d54bff3fc8681484630d7cd866e380cc9e9b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875468, "uuid": "6ba45e12-da32-401a-a669-5593ec7330d1", "value": "T1D1C40257BAED9032E8B4677018F606C30A367D611639835B27CE598E68B33B0763177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875468, "uuid": "4dbbdcfd-02a2-4498-b475-191b5f732bb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875468, "uuid": "308a10cc-664e-4a7f-84de-4749e3b71156", "value": "12288:BMrGy90S0RCP64jEcRPZq5JqOKokhPUmLrobL4uI:byURCPZjEcRPZqyOZkVLkYuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875468, "uuid": "374487e8-716b-42e0-914c-10ac9c7c8ada", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875468, "uuid": "4d9f8d6b-4e7d-449f-8444-ef25392f8fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875468, "uuid": "53a95210-30dd-4d83-a2ab-c7a2aba7a82a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071eef0d-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675853697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853697, "uuid": "9aa98873-b84c-4865-9a33-708d64be0f62", "comment": "Malware payload (GuLoader)", "value": "95ea5898870de7615ff6cc4601397f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853697, "uuid": "e90ed967-80ae-46b0-aa3a-5bff0d7c7931", "comment": "Malware payload (GuLoader)", "value": "01088427e134d579adb06eec52f721abe074c22659c66bf107c7800394427bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853697, "uuid": "6cf8b8b3-1a8f-40e8-94f3-acad29c0a88d", "comment": "Malware payload (GuLoader)", "value": "1fdb75e9a6edd7564133a2c2315cca23f48588a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853697, "uuid": "5814e452-e74d-48ce-a718-e3898828bac5", "comment": "Malware payload (GuLoader)", "value": "c098fdec877597a24c716e8b25bfc58081b00310e51b8869db57b612a32cf08366da1046378837c09418dcb8c2df96cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853697, "uuid": "faf28af8-482a-4a1d-a5f2-0686d49f0a45", "value": "T16FD412553AB7C81BC1061E749D73D67B6E732F67A9588A433B047F0E1D35280A80A7BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853697, "uuid": "56525834-280e-4c0f-a09d-1dfa9e0b45fc", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853697, "uuid": "35f3be60-49bb-457b-8cf5-fad69c2e7773", "value": "12288:FgL+rDzX8+uSoJF6qme/disEY5gDdkPDehkvK2BVjD:U2ESofo4q8gJ5hkrLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853697, "uuid": "3801964d-2f5d-4717-8b23-077e42e21e0c", "value": 601168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853697, "uuid": "b443ae8e-a5a2-470f-ab02-bd515dbf4794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853697, "uuid": "fd73f326-29b2-421d-9dcf-e1776cb39888", "value": "Fact 23_000021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a093da39-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881443, "uuid": "e151d37a-ae09-47c5-9f26-559d96ee2e73", "comment": "Malware payload", "value": "867c50852f18578fa033fa351ad79913", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881443, "uuid": "b0ab4882-6f2f-46d5-87ef-9734d971d7a2", "comment": "Malware payload", "value": "01678f0b037b244a527b964aa9c32c5f7f554cbfb77305747cf42d5019775d4d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881443, "uuid": "00506de8-fc2a-43fe-b296-f73c5e1b0264", "comment": "Malware payload", "value": "0ceba904d6ff7ad9696af3abd6d17a23645d9c40", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881443, "uuid": "da87734a-1bfe-49d6-9ddf-ad9a27e1f330", "comment": "Malware payload", "value": "039bff659d2a95f47f32910ca2605f2ffd59c9c2158b4afee5642ad2b712816c86bfc0ce614f777767211109687a56a6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881443, "uuid": "1cc3079a-1bec-4dc4-9c47-5767be658ece", "value": "T14A172311AD8BC636EA2D8177E578FA2F217ABEE3073084D767E8399A4DB04C15175F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881443, "uuid": "c3f21353-e150-4bac-a2ae-0d60492544ce", "value": "393216:9BhRuNbiYh8TB9GDpJb4UR6zCyIt0DwludpgK87gfnR3Ttf1wDAC3Zzp:n+biTTBgDpx6Qt0klur9ZJf1OAAZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881443, "uuid": "47d9dcd9-2d70-4215-bfdb-ac4a29c37bd1", "value": 19766784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881443, "uuid": "564f2cbc-061f-4a7e-9abc-28f3d8887615", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881443, "uuid": "380e61fe-0087-4d4e-b556-2865ef3b50f2", "value": "Fct63e39.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab512d8-a775-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675836014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836014, "uuid": "7ab87da0-75d0-4e57-8640-9c19940461ba", "comment": "Malware payload (Smoke Loader)", "value": "2347dcd2205ed4cc0173a598c66a59e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836014, "uuid": "c737409d-03b9-4b82-ab80-715b38a27982", "comment": "Malware payload (Smoke Loader)", "value": "01cd57e3acf592cef7173860da12ef878182a1b18a701819756fae54373e0051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836014, "uuid": "32e08d2c-2120-4dfc-8b29-a80dad6a22ec", "comment": "Malware payload (Smoke Loader)", "value": "8413e130231d3d1b5b74ced97c68a0d4eda0a3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836014, "uuid": "e06f6fad-883f-4060-b9db-c1f9d686632e", "comment": "Malware payload (Smoke Loader)", "value": "57699f7621cf6126f966f4be62607e825d26e22442b7d07659604d1adbe352262459e70ac0a7600ea292d7ada6204f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836014, "uuid": "7d65156f-c5f0-41d9-93bc-5c3c017a0179", "value": "T144643A7393D17C48E9258B73DE1EC6E8F61DF590EE4A77693218AE5F18B0072C663212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836014, "uuid": "5af12c92-c85b-4117-bf94-a8ef76310aa2", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836014, "uuid": "ea5ba845-dbaf-4bd1-8d70-0e5ae66f5aa1", "value": "3072:Iwxjq18KwXR5vhIvbd/mszl/2OpZmEyHKAR8WByUAl10nbBWu:IsWlUv2Td/vxzpZJyqAR8WUjEbIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675836014, "uuid": "8800045a-7049-419e-b2ac-0a06858cbc95", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675836014, "uuid": "01060383-22c6-4137-a348-a53239c02201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836014, "uuid": "44968f79-1bdb-4c10-89e1-55ab4820d990", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88ae58f-a7c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675872141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872141, "uuid": "47758cdf-4d67-4d36-9fd3-cd6de1d16e2e", "comment": "Malware payload", "value": "d6180c6ef7d81af0127fcdbf1841e9af", "object_relation": "md5", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872141, "uuid": "b4886c90-4e06-49f5-861d-043425791313", "comment": "Malware payload", "value": "022d1d6da141529bf2f6357fa466603d8544b4151d0d4534cd51c3e05d1dd1d5", "object_relation": "sha256", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872141, "uuid": "b1e551cc-0e57-485a-967d-70929a1a959c", "comment": "Malware payload", "value": "3516a9ba9fdce1d9c0f9ca5189ec5d85d6d93746", "object_relation": "sha1", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872141, "uuid": "3f2aa188-c772-499c-8c82-994659857062", "comment": "Malware payload", "value": "03643fe2603fbb60f9ca4b2b61373539f6602ef313eac2d85d8a4036d0f6f72864b898931e14ccf7ac136b1e872a6440", "object_relation": "sha3-384", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872141, "uuid": "6d20729d-d87c-4732-ac72-9093fd3a48d5", "value": "T101746E16A60394F6C8573AB31297D1DF3A24B709C4105F6EDFF82C24FBB6900A5B9267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872141, "uuid": "81032c09-38a6-45a7-8c14-37539c324e58", "value": "0cc8ba71b98afd867de0195f0d6030f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872141, "uuid": "f38ade98-2d77-4246-bad7-631ba0288e8e", "value": "6144:68HwSJZ88IKeVSi5CHvJITRTcKY+UC6vmtmHkRCfDg6vlIDAtYf3FawrI159A0:68HwSJG83i5CPqTCKY+cOOMAtYfweu5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872141, "uuid": "973779ba-f4fa-4285-88a2-7832964a4e7d", "value": 366650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872141, "uuid": "b15f7e2d-1c8b-4992-8666-3cca3204da69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872141, "uuid": "f074f5bb-0e42-484f-934c-130786173c72", "value": "01.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1144082-a7e7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675884906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884906, "uuid": "76490167-a438-4860-8415-5a84cf4128c4", "comment": "Malware payload", "value": "6f806ad5d1e3a62e45268c7215764095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884906, "uuid": "cb8113d2-9e5b-45bc-8a14-43f865483cea", "comment": "Malware payload", "value": "02372c29a9816b337ec1244cb4eff87d3f6ae48e39b3f076e21a25e0d1bd5e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884906, "uuid": "e42b03ff-7eb9-4bfc-8e00-ae9e97af9f8e", "comment": "Malware payload", "value": "429d2058c6d45092fadbbc8a41f8d7c477920208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884906, "uuid": "7985e469-a8ee-4e36-99d1-b6438e912b06", "comment": "Malware payload", "value": "6b069addf0fa91ed69735f2437965cefe9f3ae9d199cc724cbae190a0c99ab724835c94aad4bc36090cc08f7f977a1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884906, "uuid": "62ab44e6-67ce-49c8-ae36-fd89c91b09ff", "value": "T129C40217A7E88032E4B92B7019F642C30573BC514B78C7A6339FAD6914726F4B23676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884906, "uuid": "bc858543-4b5b-4b3f-8246-3a70aefb056a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884906, "uuid": "46c99d95-724b-44c7-9971-c11ea3727024", "value": "12288:TMr4y90j8mtebwSxnDwdYgj/Xoq1b2+8sd9Rgk:Ty28mQbjtGoqB2Nsf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675884906, "uuid": "6dd36a3b-9f14-45d7-9f6c-f056e3e8ccde", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675884906, "uuid": "30336036-64c0-414a-ac8b-479d6744a60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884906, "uuid": "9a6322e8-859c-4667-8278-10487d2faf48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9d1a65-a7c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675872123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872123, "uuid": "226b46bb-f2bc-47c8-b189-306e89b5bffc", "comment": "Malware payload (Quakbot)", "value": "489949d9ddc730a683a2faa63d26c584", "object_relation": "md5", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872123, "uuid": "5efa6888-ad81-4bd5-8795-d811ed57eb77", "comment": "Malware payload (Quakbot)", "value": "02ab9be529e1ba28087cc2a3f2f1af3d1ea50e3c05cbf26b9c36eb1d942cf953", "object_relation": "sha256", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872123, "uuid": "83a9198d-f87d-4a95-891d-2e304ec4d7c5", "comment": "Malware payload (Quakbot)", "value": "431a0d188e1ba5c7cd47f09ac0fdee6050960e4e", "object_relation": "sha1", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872123, "uuid": "69fbc5bb-4ea2-4741-a583-699320680e3e", "comment": "Malware payload (Quakbot)", "value": "01ffdc5a84e26a784fec5417a173f93be4f7b762fa33cf3b17564dbfe50f54ea367ea177e8bf6c5bca2678c841bed78d", "object_relation": "sha3-384", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872123, "uuid": "53506d9d-b4f6-4042-850f-916db50f4dfe", "value": "T10BC3CF01B2E81ADDD2F97B3185FA3BAA9336BE51A2204B3F6A91355C5DF4A50CC0075F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872123, "uuid": "3af357b4-ef63-460f-9156-c173a47efd85", "value": "1536:JIOjciqwpusMOnrRKWDehU6BpAnHdRSa4TCWM:JIOgiJcsR9hyhU6UHdRSa4uWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872123, "uuid": "d90d9b0a-28e9-4b17-8201-0c00e2dd81bc", "value": 126085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872123, "uuid": "65a1681f-1346-4093-97ec-584ced1e850f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872123, "uuid": "052c1c20-9cd6-4005-8a17-85990516f978", "value": "cancellation.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b7b22b-a798-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675850821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850821, "uuid": "37330350-689a-4016-a0e9-272edf464db5", "comment": "Malware payload (Amadey)", "value": "bf53bf5f070712d03e9e6bd3e1b562a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850821, "uuid": "ddb81336-8aed-44e7-968c-beb98b1a896b", "comment": "Malware payload (Amadey)", "value": "030555f2e2f9f27d6730649c95501050872c09a3020e637b73c0bacdb74dacd7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850821, "uuid": "b4f68059-b6e8-4ef4-98fb-645b3b8a8345", "comment": "Malware payload (Amadey)", "value": "e14b863f293e5dfc1a0dda5a16ad8a790fce7715", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850821, "uuid": "fb4db0a9-7f3e-4ee1-b45d-6a1601e87762", "comment": "Malware payload (Amadey)", "value": "dd186936e78f63205919ce3245f5615d17ceae17e59e4457eacd9ba02a8b802a4a4ed54a3fd0ac5a68c8e0f1f2b557dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850821, "uuid": "e7f604d6-1e55-41e5-b938-540037fa6f61", "value": "T164C4024BE7DD9132FCA017B149F602C31B36BD619B34829B234B6C695C725B0A235B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850821, "uuid": "e549c1ab-3afb-4962-a665-d0ad97f61c7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850821, "uuid": "26b9e012-ebb1-4e4c-85e7-281eb00fb975", "value": "12288:eMrHy90j2QH22dttbPNYddpleck9ekQscKPplAcI9MqL:ByiNtTNYba39bLhlAcI9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850821, "uuid": "5b50cc39-632a-4058-a7fb-a12c6ce30da5", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850821, "uuid": "c06afb33-4a8c-4410-83b7-b2b010b796ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850821, "uuid": "768c5997-29b6-4209-89e2-890d22d0b12d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df06baee-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893573, "uuid": "2baea1b2-3c85-4166-9a64-c4858aae6cb4", "comment": "Malware payload", "value": "ad69e788d34dbde0140cceddfb53be31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893573, "uuid": "8b05069d-5874-4836-8f04-d80a8680efae", "comment": "Malware payload", "value": "0319eb46eae010e628034af7f87be643bd30d103f67191859f41aec214b931e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893573, "uuid": "13ab52e1-9624-4d6c-b4e9-6c325e21687f", "comment": "Malware payload", "value": "3f21414d0d62bffab09dd62c6f34f0d4f214d965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893573, "uuid": "efbd81d3-2d90-44d4-bae8-fb939f95a59c", "comment": "Malware payload", "value": "567ec314affd43534a4e613b7bf973b08260269ec0aaa00ff5fa192eb0d8ec6e6095675957d86f50f32b15bd85c291a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893573, "uuid": "d126e769-f654-4cad-9533-63537abdc489", "value": "T17AC4124BE6EC8022F9B157305DF603D31636BC616B388766275FAC0E08B25F4A635B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893573, "uuid": "1bf96795-b417-4dc2-b18d-b56683dd3e13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893573, "uuid": "31e47f25-5636-48ca-93ed-454c27ffd118", "value": "12288:2Mr+y900/FFncsb6y23blD+yoqhPNJWXi0oRE5Hexi2MeY:YyBXtmVLlD+yb97qirRLiTeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893573, "uuid": "6c488d7e-1381-4ad6-990d-fbb30143c898", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893573, "uuid": "56be7a80-ae73-407f-93bc-8c0d88bce090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893573, "uuid": "42af4157-e12f-400b-9ae5-5f00297b2d59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922c713a-a7a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675857367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857367, "uuid": "6762d548-654e-42db-b50d-4bcf1e93482c", "comment": "Malware payload (AgentTesla)", "value": "cc9c959b33f78ddb98e38fbe46a48f79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857367, "uuid": "6e1dea73-8fb1-4d1e-9b10-1af38438d59e", "comment": "Malware payload (AgentTesla)", "value": "03972f21f7e4b93877bd93422c3600aa28d7c3faacfc3123c31cbf5352bdd667", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857367, "uuid": "a95209e5-6bfa-4d77-8491-d74abd630b25", "comment": "Malware payload (AgentTesla)", "value": "1c9831e897720bb8a704fed04e9a963cbbdda5c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857367, "uuid": "6eda3055-6f58-4c12-8200-e2128d0aee6a", "comment": "Malware payload (AgentTesla)", "value": "667c0c57529a9373595841a2aec07c933ad1962d0e0937e250491196ec4276a4aafdbf0d225a2d636e8360a7bab8fe51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857367, "uuid": "ed513752-0589-420d-825f-30a0fa5f7c95", "value": "T14A64233E5EAFB8011026EC24FDAC23B4569D5C7E2156D3284BA21214F1CC58BC6BE9F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857367, "uuid": "ae63ec38-7d3d-4f44-81a3-31079d77b59c", "value": "6144:VStEq5lR/QKoS8SG1r6CDQPHpSiZtOunb8MQm9Iwz+rzP7:wtEq5lR/QKnRqoPXtOunIMQm90rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857367, "uuid": "c04131e4-ba26-4aa1-a31a-d7a3cee676bd", "value": 310963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857367, "uuid": "0698dcfa-a7bf-4258-a8dd-6b8c0a0bfd55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857367, "uuid": "c6a80b9d-9121-42d5-9dd3-c8fa2a679e32", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef289c2-a800-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675895506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895506, "uuid": "4fd5a413-d67f-4c2d-a002-c28f48aa0701", "comment": "Malware payload", "value": "167dc3da2dc82add43705fd7852b6db2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895506, "uuid": "875dc993-1854-47dc-9b93-e9c11c1b72c3", "comment": "Malware payload", "value": "03b24e2e70223e0671931d771000d4888938bee3ee741d8d2a20f611adad60e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895506, "uuid": "009296d8-004e-4d1d-94a2-a88d53d891d6", "comment": "Malware payload", "value": "902e3f9beb616a49d4491291d9c167f6a980ea89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895506, "uuid": "ed565882-c13e-4418-a7b4-a0f2b1125804", "comment": "Malware payload", "value": "dfbdcf881c8676003438281012047b414fe1a45003c07d298734a4aea3dcac6c575dc0af768490cadece80ce19534958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895506, "uuid": "b969f91b-c913-452f-86bd-7400b0dc5b1e", "value": "T1A9C5017CB155C8ADC280BDB4CC3794E71CEA6DE3E994A422B0DCBF3F5579188960A217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895506, "uuid": "94b3536d-c861-4e37-90cf-e6fd88722052", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895506, "uuid": "3e7c65d0-db6d-4458-88ff-353c1a70db9c", "value": "49152:rdHQ8WSsj7fiJ0jmKvrbvqb5SKNAwKQeySrjxteYfcLCgv2MR:JHtyj3jmK/qb5V+wN+PxteY0v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675895506, "uuid": "c10614de-a66f-4d2b-95fb-30913d27ff1e", "value": 2673452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675895506, "uuid": "895e8ded-5c3c-466f-b67f-9d4e2a7f36bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895506, "uuid": "3dce5f54-4f59-43a2-b828-0825727c0f19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dc7c61-a757-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675823060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823060, "uuid": "b2b20d4d-a601-48e2-a5e6-a165f5f859a2", "comment": "Malware payload", "value": "f0ab982dc2b3facf5fb57ef32024e614", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823060, "uuid": "63181a79-5935-48db-8510-fe2100e87d94", "comment": "Malware payload", "value": "04310372728e7d99f89413982b831b9c65ab91cea14e054424c7578c15471ce7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823060, "uuid": "5271c884-5fbc-420c-a9b8-ffc0c1cadac1", "comment": "Malware payload", "value": "53115b1ab6e86a763ebf9dff5645b15eee6d30fd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823060, "uuid": "ac827e6c-03a7-44ee-b95e-e48f7390a0dc", "comment": "Malware payload", "value": "5eada9a438b42857b2c9fae94bab8d3f246044a402b1b1c876fa1a38b75de9f533392ce4ef024c7bba5d13efbed3dee2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823060, "uuid": "7550b0cf-a6a5-4b5b-84f6-332926940883", "value": "T13A2733A3181A9CDAC43164395A7E2384A875CB1E3EB767621444DFBBD1F34618EDCEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823060, "uuid": "113fbc96-6cf9-42ee-a460-ad99639b6c81", "value": "393216:tqhsJA35z7A79L+bGl1mbgafiubc2Z3bbT9i/zVN2I+TXoJKKpPbNiRSKcsNJF:s6JA35z7c57jmbBffck3xi/zVN2Ik4wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823060, "uuid": "b781a7d7-fc50-400b-aa5c-ead382d164b3", "value": 21503085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823060, "uuid": "00f669da-71bd-4530-bcde-0d0724ba9760", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823060, "uuid": "1961ee0a-bc4c-406f-83bb-ea64ec0cde94", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6652a6e1-a77e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675839684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839684, "uuid": "8aa8cb04-49a0-483f-bc7e-dbb8fdb27326", "comment": "Malware payload (RedLineStealer)", "value": "1a564f86a8b0f6addd14848acf02f3b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839684, "uuid": "87b487e5-1066-4b93-9089-c9df71309b60", "comment": "Malware payload (RedLineStealer)", "value": "0461e64be1453fba17b614e96283be58c906423af5819524715e45eb8f09e166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839684, "uuid": "7d486c46-8cc2-4f00-a57d-5a13a54e1d52", "comment": "Malware payload (RedLineStealer)", "value": "eec5bcd2c0ec5dd53763727a3954095c6beb9ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839684, "uuid": "99f79ea6-13ca-4060-aaf2-78d30f140fcb", "comment": "Malware payload (RedLineStealer)", "value": "b371f333d9e08ab699cf95cce5a34c8cd25a3983775e9b833e1bde0815c2e99eb4a36426ed0c91dfa5949ca6710072db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839684, "uuid": "9c9cb2c7-9e13-4b76-ab70-5a67c12f3318", "value": "T1D6947C5392E27C48E9258B77DE1EC6E8F60DF790EE4B77693218BA5F18B0072C563211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839684, "uuid": "aa645eab-9b39-4b2a-b4c5-6475960a47c3", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839684, "uuid": "a4d57c69-fb03-4d62-b562-fed8bc10319c", "value": "6144:5TtrUnxf26VEpwf+PLbWYsDXZ7bI4SM5JbWUjpUKIu:5Brexf5VEpwIFs976sJbxXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675839684, "uuid": "2d38311c-88fd-4f6a-a69d-551cab039e26", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675839684, "uuid": "5c399595-da67-4e7c-b6f1-4919e0e0ac88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839684, "uuid": "c7cb8375-bd43-4672-8720-be95baec87ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3ac9d3-a7bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675866643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866643, "uuid": "c529d591-0169-4621-972b-e9b4498dcfcd", "comment": "Malware payload (Smoke Loader)", "value": "f6067b16a3dd125b3262b4f9f6ce4371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866643, "uuid": "f8fa2adc-970b-4f35-acc1-90eafab44de1", "comment": "Malware payload (Smoke Loader)", "value": "04a6c0fd1049aa915baf9afd921efd548fb9672c3b6115b812e6bda9f0b053de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866643, "uuid": "56bf4efb-bb5a-4266-a8c3-cf383fb26f63", "comment": "Malware payload (Smoke Loader)", "value": "117d4cbeecba75336e7df12353311346ca2f3b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866643, "uuid": "cee2647a-f1db-4348-a853-4ec8ae035365", "comment": "Malware payload (Smoke Loader)", "value": "c77167b98690dd543794f3b80eb3a903cdf022486caa9a4dd6483f11059ef9dfcaff42763070f03312e8a1ff201bcd4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866643, "uuid": "2e58d6d4-c7cb-4ece-9a45-0d9586d6bb5c", "value": "T12864298397E1FC40E9658B73DE1ECAE8769DFA908F1E77769218AB1B14710B2C163211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866643, "uuid": "5eb38abe-f0de-4eb9-b3db-595fbfd8a28e", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866643, "uuid": "560e89e7-e0b8-4170-b25d-5b61332ea773", "value": "3072:OPR6IAxKRNc2Ke0xDlYv+ofs3oYtqX5bj8iIRLStKRxhUwDB:OZ6XclKeq6+mX2gtKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866643, "uuid": "ac009402-9a8a-4edd-a1ca-184257ace03c", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866643, "uuid": "93afa148-0e32-4979-8f0d-b061f2c936b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866643, "uuid": "a007a35b-a206-45d9-a5f4-b1fc8803d82a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cff1262-a792-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675848204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848204, "uuid": "d54c88e8-2bbc-4ac7-86d9-119d620e97cf", "comment": "Malware payload (DCRat)", "value": "9a4789ba05b618613dde080bf58ee732", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848204, "uuid": "94efbe43-ba7f-488a-9933-4023813cddee", "comment": "Malware payload (DCRat)", "value": "04ab0a9db5ad37fbc82104ba845f160d71ed6f43af8473bbe3476b65b8601d8e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848204, "uuid": "b1e9505d-af94-491a-bacd-a5410489120a", "comment": "Malware payload (DCRat)", "value": "80b6006cb779a0fcf63fefd4ebb3acd0ca24833d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848204, "uuid": "2dd9f7b8-7381-4bfa-9bcb-49460b60d0e3", "comment": "Malware payload (DCRat)", "value": "7c6d73f68fe440d25c53d3f908eccc4cc39d590aef02146655960eefc8e83b203302e7dbd1b60b025dfc23c5ec5a02e2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848204, "uuid": "7a48de70-98a8-4e5b-a92b-7c87152a4bfd", "value": "T1F095AE06BE448E92F0191273C2FF454887B0A9516AE6E32B7DBA336D15123A77D0DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848204, "uuid": "82a82c63-b172-4f1b-bf08-3d6e2bb02ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848204, "uuid": "d59d1c7e-b676-44ca-a1bd-7114513bf8b6", "value": "24576:PAeDDFJsfV7YGd8yrMdmCh4zJlHgxHkc1gScOyR2kF8fOrgbV1GxnK:IeDD/sBFymCGApkwyR2kqfOgGxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848204, "uuid": "e8afe2fe-a766-4bf4-9fd7-e4a6527146a5", "value": 1955840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848204, "uuid": "ccc1130a-d0de-404c-bb73-912972fb26f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848204, "uuid": "c3238755-f13c-48c9-8f19-424720bec952", "value": "04ab0a9db5ad37fbc82104ba845f160d71ed6f43af8473bbe3476b65b8601d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011163d9-a794-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675848963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848963, "uuid": "a622af1a-ec4d-4c5b-8358-2101649c33d6", "comment": "Malware payload (LaplasClipper)", "value": "c669c865df6df9cd986126779e7205c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848963, "uuid": "6eb16155-f2fd-4ee6-8752-8b71163caafb", "comment": "Malware payload (LaplasClipper)", "value": "0539e9a2b4707225762580ee9ccacba7ac8821841b54c5234fa625c2d39b5e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848963, "uuid": "d4a2552d-2eaa-4df3-9f6b-d2525839c45f", "comment": "Malware payload (LaplasClipper)", "value": "d3540f7a416626cbd561fbdedc307ce541fdb354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848963, "uuid": "043476b7-fe78-406a-9453-b0f092ddd41e", "comment": "Malware payload (LaplasClipper)", "value": "9dc29b3d03c4e933ca99a9bcc40f3dffc66c7d6e83d80f4887339a4457ecd5ec34f7bd57fe1a8a8832a0493f48f9c204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848963, "uuid": "4cb3e285-2c7d-42ef-a43c-12c4d10feb59", "value": "T12A5623A3535D1298F4E8C975C227FEC971B617BECFC1A879B0F6B2C125124E09A1394B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848963, "uuid": "97ef52f8-1f21-48d8-912b-4b0f5afd85e5", "value": "560f5833a24923f2c6cd395059c32581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848963, "uuid": "8d57af38-c6a5-4289-b7b8-4e9ebd7dde73", "value": "98304:63owhyyAQAyeeuTLZtQPRUfb49caT/H4EET24Yq/ODjo9p:LwhiFLTBfE9cs/HQT8qSE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848963, "uuid": "799cbe90-993d-4e0e-89c7-45cfc7d792d6", "value": 6353408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848963, "uuid": "05798317-aa63-42a5-92ce-ce7cb129c3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848963, "uuid": "8a4a1351-b4bc-4408-a85b-682f0a6b0217", "value": "SecuriteInfo.com.Trojan.GenericKD.65393943.7163.19500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c62770d-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893247, "uuid": "acf7dfa0-fd98-40e9-bac6-f4c65b34a15a", "comment": "Malware payload", "value": "e96f2e64c4bb69690466eed394e3ef63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893247, "uuid": "83fce98a-51da-412d-b5af-985f13a9aed9", "comment": "Malware payload", "value": "057a01850c142230544710ea363b2af54cd5ddbf299a103e10e9d3cbbee6f021", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893247, "uuid": "4e0c2abd-bdfb-4191-8fc1-6fd92ca810a1", "comment": "Malware payload", "value": "62e0ef047748b067296e27c0378eb8d454a215bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893247, "uuid": "1eb460c0-f93d-4656-b8e6-8045f4a3503a", "comment": "Malware payload", "value": "b8ed9d0f8df555d668a9cb7ff4feb2ce543f88f2b67ce95a8f1ebeac2c81222c335d891ba1edeb15b0e932f262b3755a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893247, "uuid": "16db8253-f999-49bd-bc70-d64d4cfe8587", "value": "T137747E16A60394F6C8573AB31297E1DF3A24A709C4105F6EDFB81C24FBB6900A57936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893247, "uuid": "317f0d14-80e7-43fb-a636-9cdf2f9c6100", "value": "0cc8ba71b98afd867de0195f0d6030f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893247, "uuid": "aaf01476-02b5-47bc-b092-7f76ea6dadd3", "value": "6144:c8HwSJZ88IKeVSi5CHvJITRTcKY+UC6vmtmHkRCoqd0WGCFrV0grgBv4:c8HwSJG83i5CPqTCKY+cORqdKCFx08b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893247, "uuid": "da5b2d2b-48e2-419d-aed9-275b8e7236ff", "value": 366470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893247, "uuid": "ea919ae4-95c7-41e2-bdae-6ab4eac68b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893247, "uuid": "a6a7649b-40c4-4f33-b346-f8969b5bcb32", "value": "e96f2e64c4bb69690466eed394e3ef63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198cfd86-a7f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675891954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891954, "uuid": "38ee5a5a-e4e8-402e-a3fb-5223d1a38688", "comment": "Malware payload", "value": "f5ef8a53dc7e4f8070308d3efdb47cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891954, "uuid": "8f854184-3365-4221-8352-757c083e4bf0", "comment": "Malware payload", "value": "05b0077a16c46f0b8a42a756abd99ff09313a92bc6d153acb5ecfec27f59ed4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891954, "uuid": "c5153a19-6f8d-4bb5-a727-b71481445d58", "comment": "Malware payload", "value": "d3a662bd279d9940e01a42519f3f8006329cff3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891954, "uuid": "ab136abb-74aa-4a57-9550-7951c623252d", "comment": "Malware payload", "value": "9fe3c1f1f3716a97b4f94fcc91e4d6af8947d9dd21c94e45a4033031606d8c5a6403165424a60d6ac7ff946cafeaa9ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891954, "uuid": "e36a48d4-9ed6-46cf-ae8a-1b78824e9366", "value": "T1FDC40207A7ED8032E47557B019FB47D30636BD601738479B278FAC1E18B2AB4A67136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891954, "uuid": "686e1bd5-554d-4c99-9851-7d9394cff822", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891954, "uuid": "b49a3e73-93fc-4c62-8e50-185660e4ae9d", "value": "12288:3Mriy90wRgHKNB4ibDt22r1SP0igZJPBEIDFgXBhhFH45K:ZyyKNOivt2YBEwgXBhhFH45K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675891954, "uuid": "0de2b6af-8983-40f0-90b2-5d57ae24bf4b", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675891954, "uuid": "e4050e2e-40d5-4758-b00e-8fd8aea6e0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891954, "uuid": "9ac738a9-a4f1-4357-8979-99b8177fb59c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b64298-a7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675868761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868761, "uuid": "76732d6b-e606-4dfe-b894-efbef0fda9fb", "comment": "Malware payload (Amadey)", "value": "76cae9e99f64ef900c878db627f09c46", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868761, "uuid": "5af17802-113d-49ae-bb71-de8f91bd1e76", "comment": "Malware payload (Amadey)", "value": "064515dcb330a6740e4204e5a2f71e9a03e962ad6d3dba3cfdf2d11b970da6e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868761, "uuid": "8e1bdb82-04a2-485d-a2e8-0db7418ef04c", "comment": "Malware payload (Amadey)", "value": "17e452db202ddc763b06550138aaf08f01ff9d5e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868761, "uuid": "1e36c5b2-7c06-4597-9a14-0430ca6771a6", "comment": "Malware payload (Amadey)", "value": "5c4464de01052a7e9beb17789dd66bc9bc81990fdc0deabb7931efd04759e2ee014ae0d87fa39bb95ea12acc4dd52023", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868761, "uuid": "136342d5-71db-45f4-bd83-4682d8f5fa56", "value": "T173C4120BE6FC4436E4745B7009F703C31A367DA16F3487AF628E790958722B4A67276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868761, "uuid": "94b026f0-dda2-483e-9e36-bd18ed6dd46e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868761, "uuid": "31b70e15-8fc4-43a7-8bbd-2ae85b4cb446", "value": "12288:hMrJy90cSqVYPfNbVZxTHGFqoaHfJ/QKx:0yvVUfNmqoaHf19x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868761, "uuid": "49dd3e96-a5e8-488f-ae15-8b9fe4109e06", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868761, "uuid": "93b063b6-4340-401f-bece-59e7312e3a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868761, "uuid": "8a882237-c1cc-4b5c-bd54-64f53eab8295", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9625e8c-a7c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675872035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872035, "uuid": "244d2a04-ecfe-4cb2-abb7-0e06c1b34624", "comment": "Malware payload (RedLineStealer)", "value": "6c1fb7ce3943169931de97eff01046e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872035, "uuid": "f7fbaf49-a5a8-457c-8915-45184a243b8b", "comment": "Malware payload (RedLineStealer)", "value": "069d373389ec12daf9206a888cace5913156685c3e1ea6389d4e3dfd8d85ff8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872035, "uuid": "5fe89350-8946-4cad-ada1-5d61da8b9094", "comment": "Malware payload (RedLineStealer)", "value": "c0135c54504518c1780a7e36448b1f25a7d14d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872035, "uuid": "73c64df0-61a7-4f1c-aca0-4e54ee0e7c87", "comment": "Malware payload (RedLineStealer)", "value": "cf455550ceb1403582dba00f31392b7c05d4339ca7d3c6e1d0f7e62b814358eed584e689c2ad6d5fbcad794d352cc8a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872035, "uuid": "598feaad-8347-446c-84ef-35284bae09f5", "value": "T165947C8797A1FC40E9618A73DE1ECEE8761EF9908F2E77769219AB1F14710B2C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872035, "uuid": "f78a745f-a235-4785-87c8-f7a24fd6eb74", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872035, "uuid": "7150590b-bb06-411a-8f91-e22e0376a89d", "value": "6144:CkR9tzyPIGiZylgL3+ybE/7PoH6KOJ0TqALgtKBhhbE:CyQiglgL3LbE/bF10TVgt+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872035, "uuid": "9045ac61-ad27-4da0-a7b1-dd0d0a73e540", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872035, "uuid": "611a5354-1f88-45d2-bade-fbe4506318a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872035, "uuid": "82518354-c274-47e2-ba5e-319073847f36", "value": "6c1fb7ce3943169931de97eff01046e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4219e8fd-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675882143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882143, "uuid": "bb0ed7be-8a41-44d1-8bac-58c28d728ac5", "comment": "Malware payload (AgentTesla)", "value": "3e04d4ccc4d545b74bea0300b1b9f64e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882143, "uuid": "0d39a880-7e63-4847-bc53-a0e1b50c90cb", "comment": "Malware payload (AgentTesla)", "value": "06badf703bdcc9a229265d43e4d986b2ddb90c3b69176c31b49359939c39f4a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882143, "uuid": "cd0964c4-b19f-4a06-8081-1a3def31094d", "comment": "Malware payload (AgentTesla)", "value": "37524dfbf3f493cb2171d96d337aa122f4484e91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882143, "uuid": "dd945fcb-5bf9-4049-b4dc-4bc49b7f5e56", "comment": "Malware payload (AgentTesla)", "value": "084924255e5b616195c09db15222832fe54bb7d1b0c195264d05f6dc56c34b5fbb275b061b82a7983575169cdf243b66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882143, "uuid": "4f49910b-875c-4b6e-bb91-ff96bb180c15", "value": "T16F641229F7F4C293EC200E701E7622631EC6E627456DB68B1B411B5C3D25AE3998D7E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882143, "uuid": "58eeed2c-8bbb-4bd7-b7ae-eed3aa250212", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882143, "uuid": "3382b541-422b-4f81-9b1b-b6e71029263f", "value": "6144:RYa6mryiPYf5ycLfkUYdZcllVK/6TIhPiC/G32d7dx4k746x/kj:RYQzPYf5gUYd1/VIP6xsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882143, "uuid": "6f163229-97fd-4dd1-bfaa-4ea982450809", "value": 324872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882143, "uuid": "6992ac69-0ef3-48a8-8053-71cfee084505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882143, "uuid": "6c352247-951a-4664-944c-e059de6ad40d", "value": "3e04d4ccc4d545b74bea0300b1b9f64e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121e2b6f-a7e7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675884640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884640, "uuid": "96d37d87-1c7c-4b53-bb86-37719ce05893", "comment": "Malware payload", "value": "22c884dd78b0ab7f6c6c5eedd37a4e89", "object_relation": "md5", "Tag": [ { "name": "80223", "colour": "#6C183E", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884640, "uuid": "1376d97c-6851-406e-903e-1bc55f5e7ba8", "comment": "Malware payload", "value": "071808d3ef79b01ad8bab9ff9d031e66ddd89d61b973dd680c7e9a8362c1546e", "object_relation": "sha256", "Tag": [ { "name": "80223", "colour": "#6C183E", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884640, "uuid": "3aca2b89-228f-4ed4-b2d5-320684585f89", "comment": "Malware payload", "value": "4674e0c2a601d15c3dc6a9e273c77b93ee44796f", "object_relation": "sha1", "Tag": [ { "name": "80223", "colour": "#6C183E", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884640, "uuid": "d7a3ddb5-ecff-4f6a-8c3c-582ef73214ad", "comment": "Malware payload", "value": "8c3cf32ac3e8be6c638253bdeb3147386010859cdad86a4abb0e3989f391160a6a34e6b6f020afa8fd1ae260c77da4e3", "object_relation": "sha3-384", "Tag": [ { "name": "80223", "colour": "#6C183E", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884640, "uuid": "a2e71d53-e8c2-4337-a69f-90748e4b1472", "value": "T18D35E041F5923EA2C12772BF88530147E67CAD6E4752DBA746C8C73B7D627806F2A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884640, "uuid": "fe2a2203-2cb8-4c91-8ebd-c9c10f27a4ba", "value": "30e4951baaf3486172393b81f9118d19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884640, "uuid": "aeb56e74-4443-4cf1-a404-59fb3f737544", "value": "24576:/cgtVNEgRC+Bk1zJGa41QUF7BRQQRNEEEh9g7aEgxPNOa:ptzEmC+W114qUdgQXaiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675884640, "uuid": "fd216031-d818-4316-8ce9-15a58533b087", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675884640, "uuid": "8e293681-3c5a-415f-994c-56da41073d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884640, "uuid": "cbd53010-8c6e-41c6-9cdb-1f81742cf399", "value": "BxgI0_95sBrYurn-nQMeZt3YnWG5c91oDH6ag2LBVG4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5ed202-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880952, "uuid": "ce83f612-409f-4ac7-9b89-d4bfa7d925a2", "comment": "Malware payload (SnakeKeylogger)", "value": "191930e9b703305fced73eb08c0c3bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880952, "uuid": "9948b104-dc5b-4e22-986c-2a4944b3b83e", "comment": "Malware payload (SnakeKeylogger)", "value": "0718d23ac8c78fde928e7d454ca33e6cc57bb9c863c40e01dd5a2256ff06a168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880952, "uuid": "6260b834-8f23-428c-8c6f-269a38d92c9c", "comment": "Malware payload (SnakeKeylogger)", "value": "99d66e106738aca2e25cf4b306dcfe34ee450c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880952, "uuid": "be410775-0b23-47b9-8d68-3ae47df789a9", "comment": "Malware payload (SnakeKeylogger)", "value": "48b0296213e35bfde5a598b3a3ba75d423c986b227b694562908564aa633b639e1505e69bf5cc00520769e9980fb448b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880952, "uuid": "2e973755-2362-43f1-a8bb-ffe1d7165a70", "value": "T153E40112B1D0C031D8A2097885F053F67D7CEE30172B54E7A7A46B39AE356E17A35B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880952, "uuid": "ffe68bce-4315-456f-bf19-21bae06ff531", "value": "53c59b75f4f7c3e4cf3b5a4fc5238353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880952, "uuid": "f4306a8a-f94e-432e-825d-ab8ca416be26", "value": "12288:T30Ot+o9Db/XYBUu7quaR8wNeoFn1MlmsreK9cqaF1CQJ5PW2LCU1ZwG:TEZo9fXYqyvYneXcuQbZd1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880952, "uuid": "d855e59d-3505-465a-ad4c-78850c2eb2d2", "value": 692040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880952, "uuid": "54149d32-a7e9-4598-aa92-a72f43dad3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880952, "uuid": "b20ee795-4082-4ac3-807e-3e494297c0b9", "value": "191930e9b703305fced73eb08c0c3bfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda9be78-a746-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675815832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815832, "uuid": "105f6860-d562-4f3b-89fa-25447cbef504", "comment": "Malware payload", "value": "baa56acaee0b5897699a8ba340744eea", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815832, "uuid": "2efd918b-3add-484e-b560-25bc5e05374e", "comment": "Malware payload", "value": "072b492a6a95545c6e46fbd8ca0c194173c3437c0cca8eca807c7db103e89d27", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815832, "uuid": "649e82b2-e90f-414b-ab67-320dabb55988", "comment": "Malware payload", "value": "63c32a3f7d0ace96f52ddf84445b18b319c79d26", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815832, "uuid": "f4c35a6d-897e-4bcc-b0b8-583e239b5a8f", "comment": "Malware payload", "value": "789deb587a494ad9f15f361c50c5a0d35b6252876cee2cef115c54483c58d79d656c0d3b74ebe381a91fdc461fa5d365", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815832, "uuid": "12439221-0735-4f00-bbb0-46d08d5e818d", "value": "T135D0221024A9CF166E8AD08B12408AE9C8A42B0830389A106390C60C220873A930B2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815832, "uuid": "4783475e-43f1-4ac3-9e0f-968dd72a85d6", "value": "6:VtGTaKq9NiP/Hs80QO0cB1OAuaHpWZMXJBNLPbMHo:Vt2qSPPs80QpcB1OAVWu5LQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815832, "uuid": "34eb1ff5-9c29-4631-95e4-ef94dae10084", "value": 199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815832, "uuid": "d96b3710-07a2-4ebc-9ed3-e0fc1aea5c6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815832, "uuid": "b4e096e1-20c2-4512-80db-49bbcad36aa1", "value": "install.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da56ad05-a74c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675818404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818404, "uuid": "1187acf5-1f38-4d5b-b967-42e494a53475", "comment": "Malware payload (Amadey)", "value": "e89203dc82e5c7f3e03e7c7757052ef9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818404, "uuid": "dabaa2cb-3e08-4617-a545-160f5801dd38", "comment": "Malware payload (Amadey)", "value": "07fdcf0ee908c2f952b55dcf1855808a1d3e165d48175db3f2b73d0755b1faf6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818404, "uuid": "a3b706d8-88c7-473f-bd46-8e01571ebcee", "comment": "Malware payload (Amadey)", "value": "7d3363e560df891280698944bde85a6388d4ee3d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818404, "uuid": "9a645c8d-fdac-4f88-b6fe-9b0357d6939b", "comment": "Malware payload (Amadey)", "value": "b43692ed3dc16be92d3e7b308204e540d1f54d49473d3a8f6635d7a0dc0679d198af1b2867d41596944fdcc1e1c303d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818404, "uuid": "4c5536d9-c3b2-4af6-9ce4-99e4f6ec7680", "value": "T1E4B40107FBE84422DDB85BB109F643C31931BD505E38839A239EAD5E18736A4B6353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818404, "uuid": "055e9a78-33c5-4b8e-8f96-21ea363d36c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818404, "uuid": "07b9eece-3ad0-4f3b-a2cd-ced44409090b", "value": "12288:lMrLy90caEV8bG0CnZ3rK10+qQlFdVGRvLWDrVX/aRM+:2y1V+CnZ3rglFrcWN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675818404, "uuid": "fd9971e7-7d6f-4746-8ffd-b7672e9bc8f8", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675818404, "uuid": "0bba7706-9979-425e-82c0-9861554cc2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818404, "uuid": "3ffee0c9-fbec-453c-ac25-52589a120570", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54e8bf4-a775-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675836031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836031, "uuid": "893a55b8-a70c-4288-b65a-e51c010d7d14", "comment": "Malware payload (Amadey)", "value": "e705d082aa25ceaa7ed4335e2659fff3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836031, "uuid": "f26e3367-f53f-4480-a788-54dad6802d5a", "comment": "Malware payload (Amadey)", "value": "0817c26a5a02a48805a2b84a5e46a3fc1abb2ea255e50826425313795bd4d1ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836031, "uuid": "4e0eead1-6962-42ff-a768-4e93048e63da", "comment": "Malware payload (Amadey)", "value": "bdea9cb421db124e0d0baff85db32b12ddc1116b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836031, "uuid": "27e3a62f-2be8-4517-abe5-0d6ea36475fe", "comment": "Malware payload (Amadey)", "value": "11da222660896754ff7bfcf45f610c84a0f27ea40eff55bce5de37dbc3edff3da22b0c7be3d4301df92042cc98fdb9f5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836031, "uuid": "1cb59083-7f2b-4e6e-99a4-a7dff08d2748", "value": "T137C41217A6F88422D8B527B01DF206C30A3BBE906B74835B764EAD0E1C73270B53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836031, "uuid": "6cf345b6-8458-4f92-ac6c-9e48cc727752", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836031, "uuid": "af1c7921-c22e-4449-82eb-2da07b2502ec", "value": "12288:0MrYy90qJweHeyMQzxHkdBVG5AJBvkLMyzxIUblOlN7:8yxJLVHaYQJkLtzFwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675836031, "uuid": "20caad3c-7da8-4214-b95c-9c4da990a877", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675836031, "uuid": "52481aa6-7293-4b6c-ba93-a07ff1b9a12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836031, "uuid": "c2732509-1f0e-4a32-b662-27c074d41c1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1b01fa-a7d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675877568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877568, "uuid": "4f20f896-0f23-41dd-ad98-6e15ffe779b9", "comment": "Malware payload (Amadey)", "value": "75dd79499e0675d1d6e0939c821245f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877568, "uuid": "c62055a6-bdd1-491d-aaf5-fccedec85492", "comment": "Malware payload (Amadey)", "value": "0819355f1cc9cfb74c24ad133996db349160cc15a76545e5783d099953721c80", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877568, "uuid": "7c509c00-44ea-4747-92a0-69c0814a3767", "comment": "Malware payload (Amadey)", "value": "a2ddc44fc4e5082a547fe9343b84758cb7135931", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877568, "uuid": "f3257467-8cd2-4fc0-9c2e-608e3ec51d8f", "comment": "Malware payload (Amadey)", "value": "3974d5bd95866246da9df38700bd836d96f158cf2094a56c5c435ea790ac6b8e8f45c5be4d242105ed92d35f15a40c32", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877568, "uuid": "4bdea69b-e2ae-4928-ba10-5b51110282f3", "value": "T148C40217EAEC9032E8F457B10CF602D30735BD556B39439B728F98691CB21A4B63276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877568, "uuid": "2385853b-8efc-4873-a5c2-0afec53cefc1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877568, "uuid": "8c7be2eb-b4cd-4934-9597-187ac7a919ec", "value": "12288:4Mrty90i7WNk/5mLwsBE8ArITHl4tOWDFjateKh0ZipCx3w0s:VyQN25mUsBuE2IWIeKsiL0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675877568, "uuid": "aa2cbbe5-21ec-4dbd-8241-e57f8cde5e21", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675877568, "uuid": "e0c02b34-3b18-4cd3-a15d-9c4950314dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877568, "uuid": "b749630a-7bbf-4830-b58e-8bdbe2fa03ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a19cc0c-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675858937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858937, "uuid": "5a761ce5-f5c4-4a73-9c6e-34812082d48f", "comment": "Malware payload (Mirai)", "value": "e96d5200e5471d08afe276e72e4f80c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858937, "uuid": "569da7c8-82ea-4f6f-a22e-6218c4974fd2", "comment": "Malware payload (Mirai)", "value": "083059e314b58f01b4eacf44d198d16fa5ff2c91cb08dc4208b6ef05f69b1ff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858937, "uuid": "24c2e186-ac0e-48e5-85e9-48728049c0d0", "comment": "Malware payload (Mirai)", "value": "434257b14c46440de16e654bae919e1be57a9269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858937, "uuid": "97aa3a00-be0d-4d73-a640-0a365c12151b", "comment": "Malware payload (Mirai)", "value": "d928cfe6dd6bec366e035e828ee8834913faa94dd56fe5f9b1fc356486f7bec53e462e2c39484f6e5c66058876d85b13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858937, "uuid": "337ecd02-9e22-49a5-bb31-472be36c5f82", "value": "T1AE539DA5C4B8BD99CF69927CB61488389723900565A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858937, "uuid": "a68f65f8-3c9f-4d9d-8b8c-387860223bd8", "value": "1536:B/bivQhunGaiwt4gpuFosvjZxwaqUfs3rBktd3UYjC1+2:BjiBGhGp+jZxtf+d23UYjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858937, "uuid": "6725a496-6c03-4448-a0eb-4f54f3fc7cc6", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858937, "uuid": "304c3352-e9ce-401c-97fb-caa8a6171e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858937, "uuid": "149dbb20-ffff-4dd3-8550-5971c63bdadd", "value": "e96d5200e5471d08afe276e72e4f80c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f120ee0-a804-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675897278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897278, "uuid": "ec6a1088-0feb-49e8-846a-033778b12e4d", "comment": "Malware payload", "value": "500fea84780df2ad76aa34f45181b020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897278, "uuid": "426470a1-9f0b-4f6d-b77a-769b2def24e3", "comment": "Malware payload", "value": "083bf42186f547b8f1f436fc1192eb4e19258d6ea2a33a7deba0a3bc84597465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897278, "uuid": "aa9d32f5-2bc7-43eb-aab8-5a55828e9e93", "comment": "Malware payload", "value": "4ded94a2136947b858c5009016e70a3db8be3ef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897278, "uuid": "4e2bbd95-5a87-40ce-b8ff-fd80a5a7f92a", "comment": "Malware payload", "value": "daaffdc0a9fd51531c14ceff2acac6eb93a41bb1363545b93f92612876293f1774a5f7db5c38267e8523f3388c93625e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897278, "uuid": "9cec1a61-0075-475f-8d3a-b02bfc710405", "value": "T172642903D2E17C85F9668BB69E1FFBE8765DF5608E4AB7653218DE2B24B0072C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897278, "uuid": "b28dd5b5-cb20-4ce3-9552-0a807bbae1c5", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897278, "uuid": "2dd3d09e-9541-4faa-804f-7db4641429e8", "value": "3072:lPg2Ej07Cn5RF+1dosEoHNDW1YR9X3uUDLFxvy9u2kqMpsWQDiuLpvm1IgvG:lpEtdPKHNDW1YRLfKXkqMOLiqOvvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675897278, "uuid": "7855b748-e23f-48ea-908d-4fd4bb563dc2", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675897278, "uuid": "f373c549-efc9-4cab-818e-99f8d731dd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897278, "uuid": "2faa676e-e4c7-41ab-a558-7e3d5b10d3c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca0441f-a7a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675856874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856874, "uuid": "7af48568-40fc-4345-9339-10b9ff1d3fc4", "comment": "Malware payload (Amadey)", "value": "48e2f2cb71c2c4319f86ea52adad8da6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856874, "uuid": "93b71818-5aac-43dd-8fc4-f3b0a8269533", "comment": "Malware payload (Amadey)", "value": "086a52a42bdf71d41eba618975ba284c56b70f34253c74c7988bd9674a13895b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856874, "uuid": "80b30821-286e-4aee-9b80-864dec789c42", "comment": "Malware payload (Amadey)", "value": "7b130c4394c322c438ef3e63b727af8263e7b8b1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856874, "uuid": "48931486-0b8a-4ee9-9a86-dfff316f2f60", "comment": "Malware payload (Amadey)", "value": "29c5eee9aa31de9f82984b2d108d02a22b91579596f909c6dcf697cfb1fbfbac620a3ae91e1042802a36d44ceddbf777", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856874, "uuid": "cd2b3e15-8bb1-4c0a-b625-3cb9e4bbc272", "value": "T16CC4021BF2FC8032E9B1177046F203D31A767D619A38938B279B6D5A0C726A0B675737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856874, "uuid": "26febf28-96b9-4286-8944-5a0eab5743af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856874, "uuid": "f214a83f-433e-4827-af20-c363f2f3cf49", "value": "12288:oMrFy90pP8EwD405Xn0kGOrbmM4d4hH20YV9fomb6gIM3SD:NyKP105kkGnMe+H2JYk6gIySD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856874, "uuid": "0baa3c41-9d69-4aab-9b22-02d51e429735", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856874, "uuid": "2d55b1fb-c3b5-4557-86e2-e3e91eb6d470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856874, "uuid": "11fbb619-ac61-4bd8-8726-b71f65d41d48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e642e389-a74d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675818853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818853, "uuid": "c51428c6-908b-4904-8550-4aca26541633", "comment": "Malware payload (Amadey)", "value": "8105d5e49de76cc6436b5e9d04af7648", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818853, "uuid": "deac33d4-34dd-43d9-ac6f-b35e278a44b1", "comment": "Malware payload (Amadey)", "value": "08b3a2273eea1c182f85efff6e53521ae55cbd1978f90428ad5c4d6a6af507d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818853, "uuid": "f319aabc-7c01-429d-a654-3bca09401dfc", "comment": "Malware payload (Amadey)", "value": "bd9ec44a10145818d154b1b97337377d8a879cf3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818853, "uuid": "7f1acf58-1cb0-4fdf-80bc-2a1b68aefccd", "comment": "Malware payload (Amadey)", "value": "8e57c7141d418b7843e2a40af651d7ae8fbc9219aea0ac741b28ad734dd5bac28e06e16ed404e9aaa11e850b124a69f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818853, "uuid": "f4c377fe-940a-4904-94f3-5be772094f83", "value": "T119B40247FAE88032D8B447B008F753D319327DA01E38979B215F6D5A28326B5B63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818853, "uuid": "381c10c4-e3a3-403c-8e81-3276aa284007", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818853, "uuid": "cb044792-c502-4d6c-9b2f-1396383dd831", "value": "12288:8Mrry9051gmVPk+TWLeqQlFdVGJvLWD3VmO164:Xy41HV8DulFrcWww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675818853, "uuid": "b6a0db74-ac38-429f-b0a4-72cacdeaccf6", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675818853, "uuid": "b6f64f6d-fbc8-435c-b6f4-0010a0877239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818853, "uuid": "d4f0c36e-1a73-49be-95b9-f64506e88f30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063716f0-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675882043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882043, "uuid": "b780e971-2160-4a2f-a37b-6bc752bca8e1", "comment": "Malware payload (Rhadamanthys)", "value": "be44f84b04c222dc68fc9f71f628226a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882043, "uuid": "81629cd4-6ef7-4642-97a6-d4f13d64299e", "comment": "Malware payload (Rhadamanthys)", "value": "094505fce369bea93fe3845a9c6318fbaebf0c0ae65411f81a2fd6541f0af619", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882043, "uuid": "868a98aa-6fdc-478f-ae68-1f54a1041ab4", "comment": "Malware payload (Rhadamanthys)", "value": "69593da42d176c3edd1656bfd72c7343c8c576c2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882043, "uuid": "bd562172-0a09-49d9-b796-7f3bfbbe5e50", "comment": "Malware payload (Rhadamanthys)", "value": "553152aabda50abe4b6d5942a5b19a866a125625e7d27fa0145c7ba9a5c2e38a824521cf59403e3778563ed792bc6585", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882043, "uuid": "4103e5e4-e5f5-44ab-9740-e023ad58cc6a", "value": "T10975790BD1EABC24F82A62F5E86F61569C387C3257952BC65D4C740DAE9C54FC8B0E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882043, "uuid": "064de796-2c47-4150-8fc9-e8d2377ada59", "value": "bcab1397e3956a9894e8595d7bb0e900", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882043, "uuid": "b94aea1e-3abf-4101-8333-052dbad1c0fb", "value": "49152:A/Syq4tn3i0rE3b8XF4OyXKVww336T2PAdWN2Yyz1g:hyjtn3J43AXF4vX2a+AdWN2YOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882043, "uuid": "a38f7829-41b3-4abf-b383-6f1a0edaa65a", "value": 1608336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882043, "uuid": "ef71fe10-b280-441f-8578-d52937cfbfa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882043, "uuid": "0b14b2a4-fb0d-4478-bc37-51c99fbb6dc2", "value": "DHL Original Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32e82e2-a7c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675872132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872132, "uuid": "832de0c2-dd9d-427c-bf08-d0aa0c646fe6", "comment": "Malware payload (Quakbot)", "value": "21066ea18accf86bcfeb0a27a419f4f9", "object_relation": "md5", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872132, "uuid": "ceb83ac5-f93e-47df-b440-5a3ec473efb6", "comment": "Malware payload (Quakbot)", "value": "096c28f01dc8b1a126055b6c691418381e8fbd0db90621073b61de4501d1df8b", "object_relation": "sha256", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872132, "uuid": "80a136b6-9e68-4b35-b8a8-197ed19f583e", "comment": "Malware payload (Quakbot)", "value": "6ccf5b4147fe267a2bf3f904cdf23341b0faa7b3", "object_relation": "sha1", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872132, "uuid": "09922777-23b9-452f-94cd-a4b1bea3aa55", "comment": "Malware payload (Quakbot)", "value": "155180dbb57b5af87a179ef10e3879ca47f4c8f1ae85bc6add35e6033e363116d64d8e849bc07d9e6e826886744158f5", "object_relation": "sha3-384", "Tag": [ { "name": "1675848844", "colour": "#A76821", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872132, "uuid": "fbe808b8-393f-48da-a9ea-a58634f1c1d3", "value": "T1222149288E2924CDC03377CEDD7432E9DBB902511F58DE27012D74BD5B9EC34E562886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872132, "uuid": "b6445f5f-57b1-42c5-b19c-12efe09a1b37", "value": "24:xoSEfTpbUsmlSeduyoH7Y8rPlVlrPHMHm5+8Zhp4XiV6JiRpS83n:HEb9AlZcjEcPlHPHMHq+8KXiBb3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872132, "uuid": "68f38b64-d00e-446b-aa1c-0e922ffcceda", "value": 1317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872132, "uuid": "59186bfd-0534-4f74-a144-908507192f8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872132, "uuid": "8d3b9589-c0e2-4690-a9e4-7822b28cd0c1", "value": "Open.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcdf435-a7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1675875640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875640, "uuid": "6c0384bb-e061-4048-ada8-9fa1f9e4fa97", "comment": "Malware payload (Pony)", "value": "8ff049e61eec64b8acb53ef37c0a57c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875640, "uuid": "08263faf-2680-4111-98dd-2b3bd6c4ea3b", "comment": "Malware payload (Pony)", "value": "09b457a2204c173c717617cc4dc3709c21e3f33e19f1e6b4b8bbbc1064491ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875640, "uuid": "cae87c46-3dca-4df8-847d-a385f539832e", "comment": "Malware payload (Pony)", "value": "b8da37f999615df1a24b2d2adf020f2f0f46cbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875640, "uuid": "f52928ab-155d-4252-b539-3bbebb39917b", "comment": "Malware payload (Pony)", "value": "d153b4a4c8def3caba66ac3f4dc43ab4b47795eaedcb05f0ac51dde3e338b398c07fbdd8c9dc8d775a265e2c35fea95a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875640, "uuid": "789590cf-4daa-4d31-a15a-64dc768654eb", "value": "T121A3E1A13DC1CC76C9660230888B67719E76C8345515CB1FA6E01DDB1EFA286DE216FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875640, "uuid": "5b396d91-8835-4d32-a814-8cd50b4a89fe", "value": "e47964f0757c688da570ec4b0b1f48ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875640, "uuid": "821c204f-eedd-4dd2-87ab-f4a8262917bd", "value": "1536:neqz4Oc5sA3NFpIbSR59ecwnJuTvmynTigBsR4T7ASytgij:vz4Oc6AFj9gM+qiU64AftgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875640, "uuid": "ebab5404-03b9-43bc-a176-76905d4e464d", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875640, "uuid": "89129ea8-7a02-4007-999c-acf5f2fbbdc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875640, "uuid": "5a24eea5-d052-45f1-b47a-b94e9bc3a3cd", "value": "09B457A2204C173C717617CC4DC3709C21E3F33E19F1E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232a92c3-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675846873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846873, "uuid": "c579ffc2-1d79-4ffe-8362-edee747b535b", "comment": "Malware payload (GCleaner)", "value": "8920030ab459623441d9e42bacd0e159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846873, "uuid": "d473a17c-0d15-4f26-84f1-399c94679700", "comment": "Malware payload (GCleaner)", "value": "09c440edc4d159f550cc31e7ebac5a6356da10ef8bc0fba3a7f02ea57bfeb0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846873, "uuid": "77c00bc6-8b4a-4068-b5a1-297478e94fcb", "comment": "Malware payload (GCleaner)", "value": "33651199d1d835f1aafb132a5843fa4330477d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846873, "uuid": "556d13ad-f02a-487d-9540-6da0f13a8e1e", "comment": "Malware payload (GCleaner)", "value": "3424e41379799cf43519ca722de24cdf34d6af986cce001e8f19cb42fe1e7fd7bbeeb6c62ffc0f133015ba911af3e9b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846873, "uuid": "1a19af27-9eec-490c-b183-3acf015bdd9c", "value": "T121C5127C7005C4ADC280FEB48D3A95EBACD66EE3E8D4A166B0DD7F3F44B9284561A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846873, "uuid": "ff836ea5-0622-4097-a4bd-3aeb679b9bf7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846873, "uuid": "06d13eb0-94f2-49ef-98e0-3f9af9ed4ee8", "value": "49152:rdHF+VJ8fjxV0djHXF6DSf9vyZo4tK9ZNNV7xS5dGfsKeLCgv2MR:JHF+TUjxV0xEDodyZVKvDV5fsK+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846873, "uuid": "97d7e58a-5232-49b8-ba18-52538b8903cf", "value": 2674937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846873, "uuid": "b3083493-448f-4c38-b773-ecc965e585c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846873, "uuid": "e849bab6-6948-4b4c-a486-ce2124c1c12f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44231a94-a7aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675858524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858524, "uuid": "9639fc4a-53c5-49fb-a16b-c50efbbdc399", "comment": "Malware payload (AsyncRAT)", "value": "725e1c369fb346eb8313e17fe8f7e328", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858524, "uuid": "54ed2d74-b0b8-4674-a9e3-6804fdb61081", "comment": "Malware payload (AsyncRAT)", "value": "0a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858524, "uuid": "02fd49ab-b784-4765-b28a-656b11e85ce0", "comment": "Malware payload (AsyncRAT)", "value": "fbcdaa9b245834d26353b9ad10d26d180c696ac0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858524, "uuid": "531d2737-b8d0-4fbc-a3d1-9aa2a42e8bdb", "comment": "Malware payload (AsyncRAT)", "value": "6ee85d883ce470c90954e056479ded77584d70802b2dcd8745d0c7f2f6d6559ba8a47010c2c421102e8d886c06c29560", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858524, "uuid": "ea59edc9-6ab6-4533-9e21-e342a3569752", "value": "T1ED232C0037EC812BE2BE5BB85DF25251867BE2273603D9493CC811DB5B13BC6DA526ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858524, "uuid": "9afc0c73-a9c1-48ac-b24f-28928da350e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858524, "uuid": "b079fe06-02cb-45ee-af28-477d4e783f64", "value": "768:4oFKMJMj5I4G3y/Nu8+7lnu1c3fT89VnbC53tjbfgr3iAvj29nnmfJ7ClZF2tYch:4oFKMJeYBn6c3fT6i3lborScYnmfErFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858524, "uuid": "6737c8a6-461f-42be-a2d8-0ea2540489a9", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858524, "uuid": "fa61c0d6-1474-496b-90da-e3eb0543142e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858524, "uuid": "7e86d7dc-0182-4f16-82d8-92e56fed0cdd", "value": "0A5556BE9428BB753FC53893A582FD42183762F198D83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56806200-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675846959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846959, "uuid": "b1024e6d-2f6d-4c1f-9eb7-585d4ae0fe2a", "comment": "Malware payload (Smoke Loader)", "value": "874a8573bbe9da63a8026990fd4f7327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846959, "uuid": "c1c5ce14-7a29-4584-9c1f-d1ed4024ed4b", "comment": "Malware payload (Smoke Loader)", "value": "0a96eb20c9f79895f494842c8cc488323f03aa7f63c94c52aa263983fa1ae548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846959, "uuid": "5adc2e03-76e9-4e38-9fe7-d8eca7a42864", "comment": "Malware payload (Smoke Loader)", "value": "e2a091f4398f1e54672d46abfa51b8928d9dabd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846959, "uuid": "ee84fe45-38dc-41bb-b393-d4ef642f0757", "comment": "Malware payload (Smoke Loader)", "value": "e576b5c9c660948c4bee3ff089b448030c1841b523522862ad2cea5c649433e3f4a69efcbae0cca51caf87da86d98d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846959, "uuid": "db042f6f-73cb-4421-b548-379e7c0fb989", "value": "T1EE643B53A3D17C48EA258B33DE1ECAE8F60DF654EF4A37793218AA5F1870072C563616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846959, "uuid": "150e28ba-21df-431d-a801-3ff582c4b5d6", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846959, "uuid": "0d3b963a-8e97-4e43-a48b-229ec7bb2423", "value": "3072:OweqUALcawXR5l4uWXp8/8YhV7fw8wy7RYN5jWByUAl1QRBW2:OrrY9UlXWXpihV7ff7yNxWUjEI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846959, "uuid": "b3bdffde-b485-47bb-85c0-9f443c088e54", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846959, "uuid": "688acde8-0109-4795-bf3b-a3b8cf4b467f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846959, "uuid": "ee40b442-5d2e-443d-9a3d-e6299896e16c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4895682e-a7a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675857243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857243, "uuid": "114830d9-7fff-4b98-b576-d24cdcfe6615", "comment": "Malware payload (AgentTesla)", "value": "70129737cc2cd212320bda63a32105f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857243, "uuid": "9297f6fa-a769-4406-aa57-b5f594af6f6c", "comment": "Malware payload (AgentTesla)", "value": "0aa6fc743d5bc7f1e32187887accb9cd1120372b644d4cd046e1fbb7814ab37a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857243, "uuid": "5d941adc-e77f-4465-b720-75f7f7977d93", "comment": "Malware payload (AgentTesla)", "value": "d35720a1b0b49379a37dd94aba65364300f9e363", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857243, "uuid": "5722905c-754e-4c70-9be0-8b98dbfe6444", "comment": "Malware payload (AgentTesla)", "value": "b2dff7fa9be87278921678fdeacc5fa5de0d2a32cd2eab83c9e5220c28f00fe48b5b5ee28a8c3c8282edd00ba075083d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857243, "uuid": "72ba5220-d3fe-4314-8d5c-a1093d4ebf4d", "value": "T18905221C2BBEDB28D97C0EB67474057147729431B523F31D4EC6B1EB2DAABA04642B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857243, "uuid": "1493f7e7-03ca-45ed-b28c-92bf9ea23593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857243, "uuid": "4280b1d6-a20a-468c-a951-1e25f3f5251d", "value": "12288:pwawHRr/CB06KuLpbhRQWijEjuTR3mv/HfSzErDPBLPdKhPTnfJ4ncUKPPUHI4FI:pwawxO5dNQjEOR3mPSiFCnh4cR+FZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857243, "uuid": "612384c0-d78a-49bd-b68f-0ef26fe3ef26", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857243, "uuid": "e3d0e877-ce12-42e7-b546-e3cc62772689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857243, "uuid": "8403acf0-3ddf-4267-b031-8ca5313ff851", "value": "Accessories Required.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d340879-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675881383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881383, "uuid": "9e9a4769-8bd3-410d-8353-0a1dab6af768", "comment": "Malware payload (SnakeKeylogger)", "value": "4817ca18b70c14360ea79b5ec8fdd904", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881383, "uuid": "73aad583-4422-44e4-8930-74b66ab00952", "comment": "Malware payload (SnakeKeylogger)", "value": "0ac0a707877a498a57174c2aec59809729f18604707dd178957ca8f2e44d2bad", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881383, "uuid": "0e6f1718-3974-47e0-8173-771e36257094", "comment": "Malware payload (SnakeKeylogger)", "value": "97712d919e3bf8cd98ce1478fc15a92674865c10", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881383, "uuid": "1b832873-5fe6-4635-b109-ca7ff6e5717a", "comment": "Malware payload (SnakeKeylogger)", "value": "f7ae7c21dfdb4c799007418259e95a217dca4cc17590efc556176693615bc2a6f4b3205d390df80aa8c583db1854d216", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881383, "uuid": "fcf61823-2fda-4692-94b5-f958e38fa01f", "value": "T13835F007E177DE2BEE26C53CE84F148282029C799948CA4E22C3772E9A367F11D7ED55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881383, "uuid": "68f53a76-25f7-4ff7-8ed8-d7fe7817a2f0", "value": "24576:QFeNyKMdhTGZ+FerF9vbEYO39P5BbQPicdqzVfTP:EiyKkGc8PbEYO39cPicdEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881383, "uuid": "d8a0d3a1-0193-4c23-994e-e153a6540015", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881383, "uuid": "faba673e-7b68-4838-ae42-f0c52821b5cc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881383, "uuid": "fa842012-eea2-4a94-9e1f-822ecaf2f412", "value": "SOLICITUD DE OFERTA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decf7bb5-a77e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675839886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839886, "uuid": "861e24c0-9929-4c41-a811-089ab17d1f4b", "comment": "Malware payload (Amadey)", "value": "8b0e0ce61fc83938bce5038a92b70df1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839886, "uuid": "2e429998-1a0a-4574-bd37-3e62802d7a9c", "comment": "Malware payload (Amadey)", "value": "0b026e229dcb07ad2b798a708e5a9019dfcaefb246d00983614d0c39f95e6768", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839886, "uuid": "a4b3576d-7781-4105-9f92-c5c0aac727c7", "comment": "Malware payload (Amadey)", "value": "9c59ef55db9ff2a5683240fe7dcd5fd3ed3a10b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839886, "uuid": "118470cc-8c30-484b-a96c-a0206042cd59", "comment": "Malware payload (Amadey)", "value": "e92efa247c975d4cd34df6d1b7bf39197ab3456808ffdb997f82fc93d7ddf2b36f3f1817b07bc5714ad8371229a9b841", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839886, "uuid": "bc56645f-5322-4fce-af77-a04c0c8f59c9", "value": "T124C40257F7E88072D8A517702DFF03D316397D706A3D425B274A6CAE08B22B4563276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839886, "uuid": "7dc986b2-4389-41ad-adb7-a6b5f71f6675", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839886, "uuid": "534a983f-61fa-4130-a77e-5fb7b9b5b9f1", "value": "12288:LMrUy90yiK18iFus0c/bLnCyGfLePVMwd3xZo29HbUbpsCtOU:7yuK1vFx0+LvGCP5blobpsCtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675839886, "uuid": "8e7e93ae-4c20-4370-a3ab-ab9dfb12958c", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675839886, "uuid": "d2e0daae-b24e-43f7-a61f-eaff06458df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839886, "uuid": "33fc6e6e-2b79-4465-acaa-196647c4366b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5a3edb-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675882103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882103, "uuid": "6b902708-38ab-4a80-84af-23c6b58e25ed", "comment": "Malware payload (AgentTesla)", "value": "97d1329dbae3b960d3c18733b574ddf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882103, "uuid": "141de76f-1224-45f2-bf69-fd11209557f8", "comment": "Malware payload (AgentTesla)", "value": "0c4b0a868778bdae7431efb22a4ce8660937bc2e07b1683105cde358ef08311d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882103, "uuid": "58d46459-34e2-4691-ad1a-a726770d21ed", "comment": "Malware payload (AgentTesla)", "value": "4f5ccb12359c1ab53101e66cecd5bd7aca821560", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882103, "uuid": "11a9ffb7-f021-4bd7-a1ba-e59178cb757f", "comment": "Malware payload (AgentTesla)", "value": "0ce46a0f4b9e56f1f1b82ea768932cd9eba745200161233afbb94f7dbe5129ccfd8faa7a15887aaa91a5aec1434945aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882103, "uuid": "de45a6a7-be6c-4e95-81aa-824eb52d715c", "value": "T1DE25DF2A23E4DE42D4A583BD89B2DBD01373B835D1A5EED88CC26CCE0525B617947BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882103, "uuid": "95478849-97b5-462c-a8a1-c165f6999a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882103, "uuid": "0f7ebd51-d580-4155-bea4-0aabe0da9113", "value": "12288:9tWlV/DfrpsRP4M/Qe0iIEqqA6kan73VSxrvynQZtnikAjz+jz6DYCCJu5JkR2eO:ylpDTpAwMYezNXn73Crvnyi23zkQHlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882103, "uuid": "a4df3b51-a94f-4068-875f-3bccd983b2dc", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882103, "uuid": "fdd1aa4d-a591-4fd5-a761-3739dcbaae9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882103, "uuid": "3edb6112-a136-41e9-9924-6f72eb338d4f", "value": "FedEx Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1857c18c-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675867900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "86e1c18d-98e9-45b0-8a51-cdb6edb68c13", "comment": "Malware payload (Formbook)", "value": "b0dd3b97aaab029d1253cb0c3794d455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "a7bd0920-325f-44f3-aab3-34cf96be4f72", "comment": "Malware payload (Formbook)", "value": "0c9d150558ddfab96bd8759e27de01b77d3517a3c337ceb4b02e23152c962ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "b0ba4ec7-0210-4014-b6f0-36bb82925bdb", "comment": "Malware payload (Formbook)", "value": "bd8d1c2321d61f038de0d48fa262e294475a4a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "2206c58a-bde9-47f4-9209-b9bd2f118430", "comment": "Malware payload (Formbook)", "value": "7051d59609f543caac40f1f001b2eb1f6cc849a6ac2e1a7183c29945b09583971434872b19fa372727c9abb4cb5acf11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "603a90f8-e3bd-4790-b37e-9a5d3c7d13da", "value": "T15964125CBE20E87FD4B685B27AB55756BEEA8D2264B8E20F33085B043473811D81F776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "776dbc01-7e16-407d-9a79-cebbaccb2c81", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "93d493c2-b272-4c1b-b0ac-f815582e55e2", "value": "6144:/Ya6kj4o1itx7zCehpKOOWebtvd0sATcV+a6CmjNA7LPkvIna6gsL0JQ:/YKso1wCUnebJ4Q1UbIa6f6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867900, "uuid": "de3a8f25-4465-4e30-9f83-539fd6c44376", "value": 318249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867900, "uuid": "84115891-49e2-426c-9a09-a5b9acf5e89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "0d04c28d-1643-4ead-a194-4dc379d58560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046574ff-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881610, "uuid": "bd928075-abb9-4a02-abfd-297fabeeb922", "comment": "Malware payload (GuLoader)", "value": "7a8b9600aa46176d0986787d1b1f3e1f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881610, "uuid": "ac7c4088-c554-45d8-8dc0-724bcfa3efde", "comment": "Malware payload (GuLoader)", "value": "0ca5f0541030610716ffd5f2c2f0d7372dca5d71e9cf0fd482a84db53fd34a94", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881610, "uuid": "beb5a8f6-26be-4767-bb08-b655c41a7c46", "comment": "Malware payload (GuLoader)", "value": "4db3fab3f61941a751c3e0a68937ed2a6fb51ddc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881610, "uuid": "80104d39-e27f-46ba-af17-e0174699a939", "comment": "Malware payload (GuLoader)", "value": "cddf4a57f909aa7bf6ce67819af49d3f467a2c6e27245e98929dcc47399d783dbf912f4d3d906bd8c3f32a9ce3339708", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881610, "uuid": "850d4a46-bae8-4cd0-8d8a-be829b0331b1", "value": "T165C36B569E093715090B2BAAEEC10DA6C439126F3026123CBDD9B38D1F0676C97BF767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881610, "uuid": "4bf84fd2-7c68-44d6-8ca1-d9b657ba0274", "value": "3072:Ftnq3Cj8Lqa7vk7F9ky7jP2WCuH+q0qHgFa6H:Dnw/ma7vk7F9kyXjH90qH+aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881610, "uuid": "626f80bd-6605-4a86-b6e4-dae15c31b302", "value": 128160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881610, "uuid": "3fb4f362-3c58-4c7e-a21e-1a29148f20b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881610, "uuid": "54d6371c-4452-4865-8031-409fbea41067", "value": "Excel_7712202816310TD01_20230228_17366 XLS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5d90ec-a809-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675899501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899501, "uuid": "23b35d27-ba98-4da3-ab62-74367522af5d", "comment": "Malware payload", "value": "beaed555048e1074fc13cdf8431abd49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899501, "uuid": "62e01f13-050a-4a40-b104-74bd498879cc", "comment": "Malware payload", "value": "0d0a675516f1ff9247f74df31e90f06b0fea160953e5e3bada5d1c8304cfbe63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899501, "uuid": "a456cfbc-b947-43a0-a2b0-5ec2dc19af22", "comment": "Malware payload", "value": "ec148ab5332da96df92e87e9b5a8e66bb517a1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899501, "uuid": "d34a8fa4-7a6d-42d1-a80e-51961135f079", "comment": "Malware payload", "value": "f79b71d6a30121b364a53cdad8278bbe39ee96cda63b2d8706dea36221fb632e51740e5a7ca0259c321e21c16daa05f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899501, "uuid": "669fe379-f06f-496e-9686-ed89c22dc758", "value": "T1CE263B07F891D1E9C1AED130C666D292BA717C881B3023D32B60FBB92B76BD45E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899501, "uuid": "51b7d4ab-05ce-440e-b0ab-ca171a4b7df9", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899501, "uuid": "007d9c47-f5fa-4f73-aae0-7363b6f50019", "value": "49152:miBXEGl3gcz9sIrb/TivO90dL3BmAFd4A64nsfJspQTc8R1zfYQKKCZCmD8IMejg:Rl3gasbggFPLEXsNhfhg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675899501, "uuid": "3080e77b-9f7f-4ba6-8576-43ad03fc9ef1", "value": 4679680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675899501, "uuid": "8a9ce439-ce39-4916-9efd-c8b1dbe08cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899501, "uuid": "5c2f60ea-fa70-4a1b-bd90-7a9c3ac8caf3", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909ff187-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675880986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880986, "uuid": "79783463-13b4-4569-9a4b-b2d8072db259", "comment": "Malware payload (Smoke Loader)", "value": "7e0085bafcc12ec4502f993a41084ce6", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880986, "uuid": "c9b910fc-1281-40ed-ac86-7c22ab5682f2", "comment": "Malware payload (Smoke Loader)", "value": "0d2740b8702d1908d1d5ff4055adde8cbf6199c34542c2522159622a4b6df1e6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880986, "uuid": "3927ce1e-3ef6-4f53-9e9b-4e15d05311ce", "comment": "Malware payload (Smoke Loader)", "value": "bd6db7e3b2abfcca517f695adce8eb6cb070398a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880986, "uuid": "7d12e7ee-91f8-4b07-aea0-951ff8c3bbba", "comment": "Malware payload (Smoke Loader)", "value": "cad9618b73385e29a7b5212a79db76c787fdff658b9f11547eda6c0699865e4ba275e7ad0ad9b65afa3ae671868b9e33", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880986, "uuid": "2d03c691-9e83-4ade-9371-6636c129a9e0", "value": "T1BC644B53A3E17C48E9268B73DE1EC6ECF70DF590EE5A37693218AA5F1871072C563212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880986, "uuid": "d3b7e69c-08e5-4d6a-a565-72d4645de4d1", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880986, "uuid": "11640444-dcd3-4987-a407-72d10f4417d4", "value": "6144:wPKQSJa5BetZBWcXzl9Cz6+nMWUjNu1In:wi2UvA60Mx5u1In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880986, "uuid": "b0cacea3-3cdf-4af1-86d6-34dcea7560fd", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880986, "uuid": "25ca22fe-ba1d-42fa-b787-42c5fb479458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880986, "uuid": "8b126e36-6f09-4656-a608-caf00f50612b", "value": "7e0085bafcc12ec4502f993a41084ce6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544f7100-a7fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893770, "uuid": "5ac8efb5-f142-4beb-8b4c-c285237d65e3", "comment": "Malware payload", "value": "63378c08c181a297c7c22843e5f9347d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893770, "uuid": "0d7f6d2b-d1c6-46a6-9224-f956eb946e9c", "comment": "Malware payload", "value": "0de7ea82be4acb882af007b3912969da1af9a4dc31b057d0e8aa549ea24ee11b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893770, "uuid": "e1593c63-60ee-431e-8153-849d127e528c", "comment": "Malware payload", "value": "40b101fe68b133df842398b9420891bde46a4793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893770, "uuid": "e39e8f9d-f659-4aee-8284-fae99fbd7829", "comment": "Malware payload", "value": "0d123010e8550dc45cb3c1893a694423769fabe1bae414c20fd73348cff3bcfee60cca06cd2379a05e4bbb0c5eb8cba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893770, "uuid": "788b0798-b7a3-4fc7-8cea-c3c33b959899", "value": "T1D1642903D2E17C80F9668B769E1FFBE8764DF5608E4AB7663298EE1B14F0172D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893770, "uuid": "73ef99ef-5c78-4adf-ae59-b3a15f5ddeed", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893770, "uuid": "d07bbfde-0842-4ad2-8684-b78bf261f52b", "value": "6144:QkiV/ACYyy92M8TMcC/TH0eD0c+Liq0v:Q1RA+a2NXCT0e49m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893770, "uuid": "43a2d6e1-cc30-42a6-a3a3-dc1b2229dd3d", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893770, "uuid": "6836a266-07b7-4141-b83a-2d9bf1f563e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893770, "uuid": "462691a9-5431-42e1-a5e2-e2d6126d6d34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea2ce07-a775-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675835725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835725, "uuid": "de77a14e-e2c8-4a85-9494-e3ec121befd2", "comment": "Malware payload (Amadey)", "value": "d56b5b599d37fa972fe0b40a0a869797", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835725, "uuid": "b7a33fe8-1d8d-418e-809e-aa9ac4f0ac21", "comment": "Malware payload (Amadey)", "value": "0e271da66f19e484a8848b6d38c42ca47dd152fdea7c08595cb659e8452ba5fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835725, "uuid": "08a0322b-5368-473f-9b8b-de280aba36ed", "comment": "Malware payload (Amadey)", "value": "4765e35c8d849d6f29a5c15b7041f7b16ae43344", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835725, "uuid": "e09d8d40-7d86-4e13-a4a4-612a342c78b6", "comment": "Malware payload (Amadey)", "value": "22ed47686e86a715fb873dc6f0c1f8bfe4a91cc643511beed62ba1107dd6e7c58cc3b63503882989dfdded5aefaac9a7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835725, "uuid": "09f395a5-aa05-40f6-9b5c-e1dcc6684b03", "value": "T14AC41207F6F88062E9B0677059F703C30A377D615A38925B664FAD4A1C722B4B93973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835725, "uuid": "374efd20-9682-469e-8c8c-949ce4c5d9f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835725, "uuid": "a1d6b4a7-d51a-4556-a02d-8fcff8da69f7", "value": "12288:YMrzy902DzSpLaAYXgpZOAJBPoLMylxbbfK2fuK/JO:by1zSpLIX3QpoLtlVjVVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675835725, "uuid": "c399116c-3ead-4e6c-a1f3-c104d40009fb", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675835725, "uuid": "ec80bbce-f9ff-4e77-8f49-64841b92773a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835725, "uuid": "e08c4292-cc4b-4532-b73b-3a51dedb0eba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd993e2e-a7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675874646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874646, "uuid": "5feb0b23-763f-42f6-bcf6-d9392a73988f", "comment": "Malware payload (Amadey)", "value": "3edb78c08971f2aa9a8e9a621678fa52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874646, "uuid": "0471979b-d96c-46e7-857b-7dd7a5b19d02", "comment": "Malware payload (Amadey)", "value": "0e375952de1156c54b66a85423d63a073845e288cb64028d4cb3a0dba8fecad3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874646, "uuid": "63491059-899a-4e05-8ae1-6a23a2096dc2", "comment": "Malware payload (Amadey)", "value": "c0695567295787e4c00daad824646a5016ca78f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874646, "uuid": "c03bedb7-ea3c-4e3a-b22f-3ae482b857a2", "comment": "Malware payload (Amadey)", "value": "ff8839f5efc6347122f1631364d52497ae3899b29a14ef47024cb4ae5c2bd6bd2d98f95e41d35efe04e39b4e873ffc03", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874646, "uuid": "35ca83ee-12af-4605-afc0-7eeb10a37d64", "value": "T1B6C4024BB7E8C022D8B557701CF642C30A3A7D511A39939B178E5D9E68B32B076317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874646, "uuid": "1e1f0b9c-4721-4160-9e05-31d9c5f9840c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874646, "uuid": "168ee2d1-eaeb-44ef-aa3c-753871e8f1fb", "value": "12288:GMrMy90zg9/Qg4n7qPBFbOK4khPUmaVwsNxlxC:qysg9/xA7EFbORkVahTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874646, "uuid": "3aafadcf-8270-4f8d-8d3c-86173420eb50", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874646, "uuid": "1d9ae02c-29f2-46eb-9ee5-e24f32bd48ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874646, "uuid": "d7bc9113-8e40-4fa4-ba8b-55731b266a0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cde8cdb-a7be-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675867156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867156, "uuid": "58cb2b5a-c905-474e-91ea-d0bffc6545a7", "comment": "Malware payload", "value": "dfbfc187e9372304356017602ff12547", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867156, "uuid": "945ca2c6-4298-421b-9cb6-0c40a3bb2e5b", "comment": "Malware payload", "value": "0e518e2627350ec0ab61fce3713644726eb3916563199187ef244277281cd35b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867156, "uuid": "0f66597c-470c-4617-bb1c-cafa65473966", "comment": "Malware payload", "value": "be80a625cb93dcfc650bdfecd48bdf7dd1bfe6df", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867156, "uuid": "102c5739-b8e7-4244-8bec-ab5a6c6fd73a", "comment": "Malware payload", "value": "b50780d767e76ef7b05a704d63830790b780e0dc2a6d127006ee032b7df99c8a71cf03269b8da3a4dbd62d1a58e6845b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867156, "uuid": "c48c1e8f-d025-45d3-bfe9-d7a991b4f253", "value": "T15E33C66AB79AC846E6552B360CE6C6E97336FC416F5B83073244B73E1FB5690CA03607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867156, "uuid": "9194b076-34e8-4d67-818c-3e8de0305010", "value": "1536:+blYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0d0d4JM46GciHfg:+blYkEIuPm3fNRZmbaoFhZhR0cixIHmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867156, "uuid": "1e128761-d422-49d1-a91a-63d3bf89e5ca", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867156, "uuid": "30247299-4f7d-48f5-a694-684a90ae96dd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867156, "uuid": "c8e11e24-ab0c-483c-b73b-fc77141e5e6a", "value": "RIMESSA_CASSEGNI08002023-4160.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2539d416-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675867921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867921, "uuid": "037eea14-8186-4507-b47d-7a517363dd5d", "comment": "Malware payload (RedLineStealer)", "value": "cfbad2341d4c3d292662ca3552ee02f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867921, "uuid": "53b444df-153d-43de-81f8-f16e389f1bd2", "comment": "Malware payload (RedLineStealer)", "value": "0e8849fae3014fbbf9e1c4e72d1022b8887665eadc0bc019860e2e90d7c7b146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867921, "uuid": "e226b88e-286f-463e-9e28-e4b12ebcb525", "comment": "Malware payload (RedLineStealer)", "value": "05d41aa92c2f419eabd34162acd9d0fd1e150f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867921, "uuid": "cc459ebd-1cd3-457d-ba9d-efb4737da2fd", "comment": "Malware payload (RedLineStealer)", "value": "7efd78653232791cc3cfab2df7906c3951bc08b6cac39b78dabf6f4ccf5bfcf9b0a3bf8d974fcd649511200e64004e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867921, "uuid": "aadbd1c5-934f-4816-a05d-c48c8dbbf279", "value": "T10264F12232A0C032C5694D355834DF66EBBEB5319679CD5B3778D36A9F303D0AA3A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867921, "uuid": "a4393941-7204-40d8-960f-ad091204e90f", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867921, "uuid": "582e2af6-fbaa-478c-ac18-cfee27fcad88", "value": "6144:4JMBmqLYi0SWqL5vwOxmzeaO9boa2a0I4k8W/AZk/LifX1DiuE8:4JMBmqsizLzxmzFobTh4k8gA06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867921, "uuid": "143a01bd-c75a-4370-ac6a-504cb2c608fb", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867921, "uuid": "ea3f5d10-2e8a-45fe-a905-48682e91c007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867921, "uuid": "966a459b-b37e-4463-9e54-152b9fc84b13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0cc332-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675881514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881514, "uuid": "7e64ed22-24fa-40b6-800d-b00b337377b7", "comment": "Malware payload (AgentTesla)", "value": "a295e6e21db0721a320097037bb7c8bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881514, "uuid": "b08ecab9-a79f-4b2d-9cd4-07c89a375644", "comment": "Malware payload (AgentTesla)", "value": "0edb5696c64d953e3971f957170c1e70c8d279327154dc46298bec61e88dec56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881514, "uuid": "2afe7d32-0641-4e88-8a90-afdbc9741d66", "comment": "Malware payload (AgentTesla)", "value": "251e0810120dd24746375ea9d57671b35eac2013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881514, "uuid": "407fc117-eb8b-4ced-9c93-69076272da65", "comment": "Malware payload (AgentTesla)", "value": "ffce07c2e7c030598b81c8055a501eeb4162bd55713c5a69f8b8c56e6f14bc603c75cc47a3ad0beb20043c0d0312042f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881514, "uuid": "d82de1e2-ae1b-4761-89d0-64670f86eb00", "value": "T121C594E1395D2F36F7A3A517C2615B2B2824C2D30A4B2313B69A3F50DF595843EE6DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881514, "uuid": "586c38d7-c719-4d3c-8309-a698294cea57", "value": "3072:20k78j1V5UvXArRgq8CRuiezvjyJKr+jWeMUsFgVYWuWQ+OTWAF5hxYQP2X5WtyI:20k78j1V5UvXArRgq8CRui7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881514, "uuid": "44b46565-84fb-4c99-847a-921e266650b8", "value": 2608563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881514, "uuid": "d40489f5-6182-4296-a624-3ba065bd0790", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881514, "uuid": "cc89eb8e-e6b0-4e3a-854a-dda8816a4f4f", "value": "003500271.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb29187-a7c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868474, "uuid": "0681a6b9-a739-457d-bec4-6c80950fea5f", "comment": "Malware payload (AgentTesla)", "value": "5bdafeb9a1aa3c72aaed5e866b63b30d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868474, "uuid": "6c205717-e2da-47ae-abb2-41e1f74d35b1", "comment": "Malware payload (AgentTesla)", "value": "0efc6634b2231b6b51a7c32625a02bd96d165d7009be041320e60f73c2d3dd03", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868474, "uuid": "cbb5a830-8baf-412c-b80a-562481176540", "comment": "Malware payload (AgentTesla)", "value": "63192bf65c4bdfd1cd3f5ca612e3456cb46041e3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868474, "uuid": "4c0bac37-cd2c-4919-bb7a-5949a8ac152e", "comment": "Malware payload (AgentTesla)", "value": "dd17d2010ce953ed60d6238956a36427e50f90331af354b827a0ee601909d822cf9b54c3004fec720097897b74c8a64d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868474, "uuid": "e8541c55-41e8-480f-b91e-cafc8b5ef491", "value": "T167B4236A1951B33FA792C8F9B60E9D25A91F388091F61E317510EF4BE2B563BCE050D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868474, "uuid": "e0e92c8e-fcfe-4698-9fad-6806dcd22b95", "value": "12288:q0q5l3hAkUILXgv6Fmv7S5PzLlWji7/V6I16u9nFs9Ow2ACT3:Z2RE1SZzLlWjwj16u9niDCT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868474, "uuid": "c7597b04-52ba-4456-a772-b8280d1b2a0f", "value": 527555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868474, "uuid": "7ac4e603-b0f4-49e0-b342-1ccc39d19e89", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868474, "uuid": "043a18e8-971e-44c3-852f-6eae4b2c10a9", "value": "PO - 12619.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1ffe2b-a749-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675817143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817143, "uuid": "254fb7e2-c8d6-43b1-8b6d-233003215ef0", "comment": "Malware payload (CoinMiner)", "value": "84862aeda4f10279f6c1181bbc842ca1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817143, "uuid": "f11b3249-b1ff-474f-a0db-2eea6f3b5c7c", "comment": "Malware payload (CoinMiner)", "value": "0f26e57fdaae826c1af166660c08d2bde4a6b03864f30c7c6e1ce3cb036bcafa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817143, "uuid": "75435f8b-26ec-4cb7-901d-55319916ff6c", "comment": "Malware payload (CoinMiner)", "value": "3205b6e75684a05e1afa1e0e15eedfe5548bb1b0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817143, "uuid": "aba3e41f-3b06-49d0-a270-612057004b69", "comment": "Malware payload (CoinMiner)", "value": "19de106b34464e12c07623b0300f871fe01595fed21df9e3f7b6296a0991b0b8b6c1d6270b36e972745a7c0b8ac2c9bb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817143, "uuid": "aa2ef7b7-f898-4410-8e0f-4868594100b5", "value": "T118638E15238B46A2D16D467688B3BB742322DD2274E2E38F768C352D6B733C605537AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817143, "uuid": "e56aa622-bfeb-404e-b45e-0cf87ca7b77d", "value": "768:GgccWWhZ6V5rkNUQ36xOA82qLNm+N+Bek8j0X3/zEn2cUxsvpNg9F:GgcfWho5rkNp0OA8Fg8erEn2c/m9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817143, "uuid": "8e7f5899-b082-4977-8748-816497db18bd", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817143, "uuid": "bdcb4e21-c991-4561-91dc-946dafd9e905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817143, "uuid": "6a537783-60fb-4cf0-ad0e-61ca35f7fb85", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f47322-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880880, "uuid": "ea679df3-7df3-45b5-8fb3-ce94d311ff1d", "comment": "Malware payload (SnakeKeylogger)", "value": "317dd7f30dbe83a609f0c282887af0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880880, "uuid": "810e15e3-553f-4b7f-8a5c-6657b9593059", "comment": "Malware payload (SnakeKeylogger)", "value": "0f467217bcccaa0eb494cb5da8e328cf5d16639ff4dc5d0cf56df96895f19a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880880, "uuid": "968d5707-febf-4df7-bc1d-03e42772c670", "comment": "Malware payload (SnakeKeylogger)", "value": "99a4d529c48856ab4f436f09731086eee56fa7f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880880, "uuid": "b9a78337-17c7-402c-851e-e4fb617e9356", "comment": "Malware payload (SnakeKeylogger)", "value": "6f677928430d6582beba5ff0b2ee86fc8fffab45618227ab0d5377031b2890bcc2bd36c1d71c0709898a82d6992b97df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880880, "uuid": "11d21675-b8e4-4fd2-9215-81640d3fc669", "value": "T1981512203154CB60D56C4BBDC870EAF167756EB4E960EDE36EC1BEDE7A313A15090AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880880, "uuid": "95d4d42a-77b6-48e7-a3b6-933c0b3cb115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880880, "uuid": "8c2aa097-a963-4ff5-90ca-9ff613eab939", "value": "24576:Y1bgzPGhgzfYrwMYe1PUjt65AIpU2IPteL7ycA3:YZyPyywrwMYeu45bpBQteyr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880880, "uuid": "f8911018-b8f7-43ff-a6d5-869ef31fd15c", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880880, "uuid": "4b8cc697-7249-4488-9100-94452aa1b1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880880, "uuid": "82677a31-76ae-41b3-9642-60e6c52da491", "value": "317dd7f30dbe83a609f0c282887af0fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441b089a-a7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675866255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866255, "uuid": "9563b06d-4dfb-4e7b-81d1-f6d939e501a6", "comment": "Malware payload (RemcosRAT)", "value": "35a393ae8fc738a476259ef1893d8119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866255, "uuid": "aa6b34db-37d8-4d1d-9067-fba2b98f07cd", "comment": "Malware payload (RemcosRAT)", "value": "0f5a9777480bfe11af4c7977505709f7ceb87d30f886887ca5f483533912cf68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866255, "uuid": "aa44b529-4d3b-41b1-83f8-0658ad9a6101", "comment": "Malware payload (RemcosRAT)", "value": "1af166ae6750f9bb7adb568b91489b40bbe100cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866255, "uuid": "c8025519-dd9f-46dc-98d7-2c8a0f1b113c", "comment": "Malware payload (RemcosRAT)", "value": "997d8019205d8aa611b2d253887c44ab31cea59faf3459200f928331609e8594185db5b72899b1841e55907d2e8d39db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866255, "uuid": "a8cb85a1-1cfe-41d9-b967-07760c17afba", "value": "T148C42340A6A0F577CAF10AF66D3606876CA1B8561CB36F0F7315ADA233369E1D71E360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866255, "uuid": "5ee5f4b7-272b-47b8-8e23-5dcf243c4481", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866255, "uuid": "2b4ad4eb-9083-44b7-aff0-2facfd8e2aca", "value": "12288:/Y564jBPCi81JDLdm6OkKzYqGW4tnVERE/Y2X/FUL5gfM:/Y5BYiKLd5OtbG/tnt/Y2eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866255, "uuid": "4685b087-f508-404c-b6e2-1b7e135a3108", "value": 545184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866255, "uuid": "22b88abe-5fcf-45b0-95e9-e9c87ee7c03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866255, "uuid": "235088de-054f-49b9-bfdf-e3f5bf4e14c4", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af08e575-a7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890057, "uuid": "8ba9513f-1129-4eb6-b1db-127dfde399a1", "comment": "Malware payload", "value": "cad43d2e878e78ca6cc88551c85cbc95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890057, "uuid": "64de2a6f-d540-4eda-89c4-c58440cdbdb0", "comment": "Malware payload", "value": "10584cd18f21c2e0b606ddeb4348b5283280221fb1aae6ddd1161f290a507732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890057, "uuid": "21a07962-1b3d-4ba7-b049-2720ae411082", "comment": "Malware payload", "value": "4a8ea49d82846789c9de72cfbccdd18bad643632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890057, "uuid": "1d991050-2e56-438f-bb3a-7d89cbd30ddd", "comment": "Malware payload", "value": "f7e032ed40d975751c17348898600941353ee2115d35e01882c2caa462d8fe3f995099b0c4e11825f14b24d322478db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890057, "uuid": "acbb67ab-2f04-4174-ac1e-b4aa3e6a70ae", "value": "T15F641903E2E27C85F9258B769E1FFBE8765EF5608E5AB7653218DA2F14F0072C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890057, "uuid": "5f8bd78c-ed42-4a50-a571-b8e3ea7fbb44", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890057, "uuid": "2f6a62a2-ddb1-4ff5-99d2-1f626674e83b", "value": "3072:NPgkKjQ/U5RFjk8GH6fd8BEbC9sUaHGhjZ7mQpG8sWQDiuLpwFPgv:NrZCjIH6fd8BOC5JZ7m2GZLiqwFov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890057, "uuid": "c2cbd48b-1e6b-4fb0-80c0-8b9d1fa3a540", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890057, "uuid": "4791b46a-28a3-45a5-a8af-dc70ddb9c19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890057, "uuid": "f8b99056-ecfc-4a5a-971b-756e506d93fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c6f412-a7b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675865204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865204, "uuid": "35da05c3-1b9d-4181-a66d-d9382a982002", "comment": "Malware payload (SnakeKeylogger)", "value": "b7820bc9cd73d4378a5d7017aad0b803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865204, "uuid": "afb59b58-821e-4155-850f-47268d6aaeae", "comment": "Malware payload (SnakeKeylogger)", "value": "1092d7ec9366334de4f4a244154a01816d343523764573546eceec51f5e36976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865204, "uuid": "57e6f58d-bdef-4afc-976b-7cda492b819f", "comment": "Malware payload (SnakeKeylogger)", "value": "d5df3228d5683a4648b2998cdff593e667860ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865204, "uuid": "6a619c7a-9e61-449c-9088-60cda94e33f1", "comment": "Malware payload (SnakeKeylogger)", "value": "51cf806f22a10c95f4444602da84c208208ad28996a74aed4d16ee0800ed48231f263acd7a233b86cffa11d22af04238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865204, "uuid": "132d9c6b-e3aa-4b6b-9106-d7175fd083ac", "value": "T11C1512653264DAA4D86807BCDD768AF053B56EB5F861EED72DC63DCE3A327910010AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865204, "uuid": "93e80441-680a-4216-ad05-bdaffb5b71f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865204, "uuid": "dd0ef9a6-ffe1-40f9-b3b2-4f94aa3e2c18", "value": "24576:J1bgzPGhgzfYdqVEtFAE7fNnACQ+iZ0EwMYeT:JZyPyyw8aeCQ+M1wMYeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865204, "uuid": "b2de3a5b-ab7f-4dc1-baa1-62d771c0e391", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865204, "uuid": "596c6881-bf5c-44be-ae98-afcc318c8005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865204, "uuid": "c630d139-080c-46ce-9dd8-a413408f6a26", "value": "arinzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e4c9e7-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1675881499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881499, "uuid": "fc013d4e-00f4-4957-a9ff-0a41db47336e", "comment": "Malware payload (WSHRAT)", "value": "99445c9b0d2b3fa7ede291b09a519451", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881499, "uuid": "e7d8f1d2-8ba5-4af4-ac65-8b36b3e53dbe", "comment": "Malware payload (WSHRAT)", "value": "109cb5c4ab82b3a0d138af93ae0df6c03049574baa8d72ddc4bf2152055d6be7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881499, "uuid": "e44446b9-6337-4034-bae4-0f6fb347cace", "comment": "Malware payload (WSHRAT)", "value": "6e7532fb6838801cac249e26c2ac8e146f99804a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881499, "uuid": "7b585bc9-5ddf-4a6f-9a18-c6065975328a", "comment": "Malware payload (WSHRAT)", "value": "c8ace7a01a195ccdbf3b5187f5a88968c27b48893a06d125239d9fb813e25c668e6dfa5a21298ce7f13678b7fa64fedf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881499, "uuid": "d64fe85a-e47a-4acc-be1d-9d8dffa25992", "value": "T12BD573562C0D2F35B252B413902E2A271464C5E32E771323E1AA3F5DCF5A99139BEFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881499, "uuid": "d6a31e54-ac1f-4079-9b66-c3faea6bf81e", "value": "6144:Tcd8ncIBhvCj8wD33mMrJwSScFGJUQBju://Bju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881499, "uuid": "8b975eec-068f-4551-b362-8675f037dc8f", "value": 2816117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881499, "uuid": "dc18893e-f7ab-4461-836a-6611e7b76873", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881499, "uuid": "79656122-1fb1-4883-8a85-6ca836509cd4", "value": "Scan00551.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebf46c1-a7ff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675894969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894969, "uuid": "1472ae0f-ae9f-45ba-a704-c499f23031bf", "comment": "Malware payload", "value": "eea9a13e55dc78fa51629bd1a2f3576c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894969, "uuid": "6599aca7-2a73-42e7-8f9d-675f426ddf43", "comment": "Malware payload", "value": "1177672bb473887c546d06186df9b67db3abf021768f3eacee66cdc10fd3c095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894969, "uuid": "b8b4dcb5-9452-4c62-a762-a01635b681c3", "comment": "Malware payload", "value": "47fca658f508ff2e087e5d57070ddb96129382ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894969, "uuid": "a8cc7c33-3c2f-4964-8a72-74674911d6c1", "comment": "Malware payload", "value": "fe5ed7301b304fd935748675287ac88ab88877b7acc12b2ff923f1da4dec4c180e9bf73ad0c927de1f60b81cff02223b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894969, "uuid": "651301b5-37e7-44df-bb58-fe7ed551050b", "value": "T13B951203D2E17C90E8258776CE1FFBE8765DF9608E4EB7693218DA1B15B017AC1A3724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894969, "uuid": "a8341a73-bd86-4eca-89d9-1db29679a4f7", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894969, "uuid": "66f7f2ce-c00f-4c0e-a611-9f6e3e6df9cc", "value": "49152:pyPG+gec9PQb1+CJ4L/p1XVCqSqMptKr8fpUFh:olgel+I47fXVCqpMCr8fqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675894969, "uuid": "121054d1-5817-42e2-b1b6-0fd53fb9d5d3", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675894969, "uuid": "bc19a933-49bb-4827-b33d-c62b08b37b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894969, "uuid": "eec8c649-445e-42ae-9f58-647b774a61bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eb0ada-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675859229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859229, "uuid": "228750f6-0ebd-4867-8316-8e4e0e1230d4", "comment": "Malware payload (Amadey)", "value": "7f09245c3442ab994873bcfb38182f41", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859229, "uuid": "6a81ddd7-d2a0-4a76-af37-aa178754aeeb", "comment": "Malware payload (Amadey)", "value": "118c1792a869c25185de6f46157ebc0c268c4960e3ca5c4c3257089b8be9845c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859229, "uuid": "e1653191-f200-4cbc-b58c-800915c47cd7", "comment": "Malware payload (Amadey)", "value": "8b8dd7084f23d3be8552949ed99832b3a8285115", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859229, "uuid": "35919345-af55-4479-996d-98fb0b8e693b", "comment": "Malware payload (Amadey)", "value": "4488716f0afcf6ef2677d94a40202340c30b593fb58b5b0948207b6271df14b39230c6bea6abf23e53eb50e93cb28fd3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859229, "uuid": "9ca5a6ea-0e74-4768-baa8-28e5285d4da7", "value": "T1C5C4020BE6E88173E9B197B018B203D71A36BE412F3CD35B624F6C5A1872578E635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859229, "uuid": "e9bf297e-ee81-44b3-9866-b88276491e13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859229, "uuid": "21e52ffb-8eb9-48e5-a7e8-50f56a9a8899", "value": "12288:6MrWy90p+x1ILqWgelQOdhq4YiCPxZlW5JANM9fgVShMmDURHG:sykzQz4YT/WLAOdrhM5Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859229, "uuid": "4756d44e-4b3b-4238-9c60-db741ef49645", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859229, "uuid": "46326245-92a4-4f75-8bf4-3ad349c1401a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859229, "uuid": "7d0c2193-fc51-4ec8-bbc0-91eed9e74b4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2d8b62-a7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675863044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863044, "uuid": "7ac25ac7-ecf2-4924-a7e7-84439ed21595", "comment": "Malware payload (Mekotio)", "value": "87e80bb294c14cbf60deda9992113859", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863044, "uuid": "b4255823-c99d-4655-af15-f34cede49166", "comment": "Malware payload (Mekotio)", "value": "119185c921128618a213f5bd825df3a354bd802f6361972713e65fe2890a8a6c", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863044, "uuid": "da959a12-5645-4d0c-8654-3d3fce1d4b7a", "comment": "Malware payload (Mekotio)", "value": "f4fce6ee5238e285e28be6f25f2689a10f93b2f5", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863044, "uuid": "84a66ee0-c817-42ec-b400-52f56836162d", "comment": "Malware payload (Mekotio)", "value": "1322ea5b2426d0fa88129f256d6214125b0f9a5e231a59de972d81685aa489a14853934897afe2c8604402e422ea38a6", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863044, "uuid": "80f31791-8204-4f82-8011-8c4b90d5586e", "value": "T1B9E633903087076AE7597E49EFF65CE70C84F649A4A88E15418B953EEFC1222FB1F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863044, "uuid": "028a5c29-cc25-4f2d-875e-7bdce9eb86e6", "value": "393216:lK84AqkQMzYDEddNmhf92ZrkN0csbcUMpPdYq6MuNVB+t4OGrgi:Q84MHwEdP0ANkylbcHFYVSt43r7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863044, "uuid": "7d0d10c7-7187-427d-86d0-533476cba34a", "value": 14484484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863044, "uuid": "4123286d-a5b7-43ce-8892-6f900716329d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863044, "uuid": "7068e3df-2beb-4db5-9be3-00713de132e4", "value": "payload5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf0a689-a7d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675876041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876041, "uuid": "1f7a8184-a15b-41d8-b7d5-d35a24bd2eb9", "comment": "Malware payload (njrat)", "value": "9fdb4688942194838315a9935f64182c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876041, "uuid": "97672d2e-1de0-4f96-8353-afeae9370107", "comment": "Malware payload (njrat)", "value": "11ad2567eac856e69a0e013936830a52614caa6b3a1e2da4ca8ad08c995b72c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876041, "uuid": "cdf25edd-1bee-4cda-804a-00037c72bb66", "comment": "Malware payload (njrat)", "value": "b4a59f879418001b094653d7cad1b898a6f5eb59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876041, "uuid": "62594e3e-eb4c-4ab7-b20a-6b51195c3576", "comment": "Malware payload (njrat)", "value": "1e5294405656f22a1ab74ac1383d767a4f42bad12c6a9134b14181fb3409e48770790c9cb051f1b01a47458bf7284071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876041, "uuid": "f00e812e-6c26-46f6-8c1b-c187d3676aca", "value": "T1A9733A4877F54A12E1BF0DB5897292220B35FC076D26F76D09D174AA5FB36C08A09FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876041, "uuid": "9da2ad0f-1fa0-4828-a91e-6129cc7f15d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876041, "uuid": "574b07e2-998f-43f5-857b-e260eb64655d", "value": "1536:IkUM+seTFDpJS5wpOk3JCK6pFoFfr6fOpd/9nEh9TG6QqR:QQwpOk5CK6ZO/9ES6Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876041, "uuid": "e787f3ba-32d6-42fa-a656-d0d92cad65b3", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876041, "uuid": "0e2fe096-e9aa-4dde-913f-92e078fbaee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876041, "uuid": "f4f51783-a5b9-4bb6-814b-18f42cbfb7da", "value": "bJ5I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d521b48-a7ed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675887370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887370, "uuid": "4bed6a5b-e986-467c-b5f5-da1f78380e4a", "comment": "Malware payload", "value": "3dfce2b2aadcf26d003f64f7a8c4a54e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887370, "uuid": "73048057-5fd4-428e-924e-880c6fcd24bb", "comment": "Malware payload", "value": "11d06585ee841eeb25af2fbc9bea225d2adcd6f683d346762ccc68da61be8d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887370, "uuid": "db70ea0b-7ea1-4955-a89d-691d5c9b2a4d", "comment": "Malware payload", "value": "393a7c7c6e17c638afba476a2697deab0208db71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887370, "uuid": "f9f82943-8d93-437e-8ff6-a2f89ad20630", "comment": "Malware payload", "value": "d5b29416ad7a28b57b240d55b09504942215f5f995311d95f3bc5aae43fd84d84ed6fd3ab0ff82f8725efcd893246821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887370, "uuid": "1bce0565-f56d-4169-8a47-bc6821765bb8", "value": "T197C5123C7101D4ADD280FEB4DC3AE8E70CD66DE3E9E4A06274C9BF3E92791895A19507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887370, "uuid": "a306d90d-8097-4da8-a1f5-d1220b55e142", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887370, "uuid": "b7eeff60-5d39-4563-aff6-b9ed060705d3", "value": "49152:rdHNx3bTF7h68Xtrq0+vPYZ/Upzp4aHTYT+sLRcwhp1YfBnf3LCgv2MR:JH/31E89AvKU0OTYCgaJfDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675887370, "uuid": "2ad7df17-fa99-49f7-a352-2671bde18739", "value": 2733218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675887370, "uuid": "81800827-31c4-4bc1-92b9-7c32fb57fdce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887370, "uuid": "4cd7216f-a68b-4794-bf9b-eb39391c5688", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df47dfab-a7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675873387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873387, "uuid": "6f5c88ab-f616-42c0-91fb-f880a36b1f01", "comment": "Malware payload (RedLineStealer)", "value": "e707904aa6b1ba9916fd834bccfca247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873387, "uuid": "c7cd8690-d3d2-468a-8869-c084de385bd4", "comment": "Malware payload (RedLineStealer)", "value": "11f80300807b6c0c8cd04d845552ac3a7c641a712896c4f1ba1d0a51189008c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873387, "uuid": "ad6f51e7-9f66-43e4-b2af-505d06817a05", "comment": "Malware payload (RedLineStealer)", "value": "717d80e2f40233f1cd5c218b524cfbd529b5009e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873387, "uuid": "a539d2c7-9e92-433e-8db0-5aef6a0d93b4", "comment": "Malware payload (RedLineStealer)", "value": "46aa438a0c5d0196be99cf647995106496a23afdd6010543ec472b4b3a1d26fb81363a93f61ca12e02b6d2be438dfdc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873387, "uuid": "cb76adc7-1fbd-4566-8c8b-d5f31659f2f0", "value": "T18DC41247B7E85036E8B057B018F643C30A397D615A38835B378EAD4E28B36B0667577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873387, "uuid": "932bc62f-13b1-4988-bcce-ea7bcc4f9b96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873387, "uuid": "0317bd69-c0a9-4704-9e28-947e512f0508", "value": "12288:hMray90NoCMBfyRroshRcASoq+6mKokhPUmCZEFFvmXgDQ09i:3yPxBfyR3hRRemJkVCZ6lmuQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675873387, "uuid": "aa7c099d-e21c-4cc1-b520-67bcd8ad232b", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675873387, "uuid": "39353126-442e-4706-90b3-d9675f1c9ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873387, "uuid": "466441d7-af62-412f-ab29-8fa14e2715d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a001bbe0-a7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675862973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862973, "uuid": "6dc76933-893e-43c3-9314-7c2af822f4c8", "comment": "Malware payload (Mekotio)", "value": "212a49385ce0493d1d48313383db5107", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862973, "uuid": "87af121f-7712-4868-b0e8-c470cc0db647", "comment": "Malware payload (Mekotio)", "value": "1234a3f8eef3b154cba0632b797b4dd74a10e14eefdedbc428c25f928f0bc6bc", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862973, "uuid": "7399d97f-5b06-4481-994a-a29d1ac3139e", "comment": "Malware payload (Mekotio)", "value": "b0fd44781e1b839932ee2a72df51b3591f503b30", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862973, "uuid": "3e9f7c17-b817-4afa-b350-d3017b4fd55e", "comment": "Malware payload (Mekotio)", "value": "331ca09971d28e255fe0b10db3fe1aac80fcec007ca1f3b915b26fe00bde1b580339d43d4eb6faa7928f3440da0f5509", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862973, "uuid": "0161d931-c84b-4fe3-b0de-8ae95135a2b6", "value": "T1FEE633940F3E594B27864CDC6F50FDD76C6D6EF5A00FF062992B42FA4E8311860EAD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862973, "uuid": "a52ac7af-6c08-4d04-9b1d-a08b42143f3c", "value": "393216:XowobAX207l9rvH/n9WLT6sg0S5P6LumdQCka3x5mWacmKs:XoQHrvsLTpgM6maC53VRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675862973, "uuid": "79273363-f02c-480a-85cd-9caf039262c9", "value": 14626959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675862973, "uuid": "f450a158-d458-48a1-b2b2-615f5d9953e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862973, "uuid": "8b76af5a-7f75-421e-bd3d-6e5c752b05d2", "value": "payload2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b48a5e-a7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675869108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869108, "uuid": "8e014ee1-022d-4edc-ab44-f4175a476c07", "comment": "Malware payload (AgentTesla)", "value": "fb3149bee21144886c0ad663850a730b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869108, "uuid": "6172f1c4-464d-4cfa-be89-c9cc37d6acab", "comment": "Malware payload (AgentTesla)", "value": "1284db12c0efe2e484f2bcef4c09290cb9cb82e381c366ae3a157ecd4eb317cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869108, "uuid": "74bd566e-7d0f-4ac2-a091-d48759738886", "comment": "Malware payload (AgentTesla)", "value": "62df7ce2de6f47a49b1380677f918baffbecb224", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869108, "uuid": "f2c7f740-3ae5-477f-9cfd-678007972fa7", "comment": "Malware payload (AgentTesla)", "value": "696e85b3180d922f9f578942a5785cbb245e8924964f365448d76f226111541b7b23fec5b94e6c0d5d035dfd00d4804e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869108, "uuid": "b0792a11-3cc7-40c9-980e-16b8888e6418", "value": "T12664230C4AB61DDE63DC8B7F5CE407DA7A309A5858A8C7A2F4313361019F4B90F459FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869108, "uuid": "e4d0a28f-3520-4fb1-8e73-d10f6ab9f65b", "value": "6144:ZStapJ3i6eYpDee+cf3SVARmbWR8D3wZZe/hJ11vRaMCjkGXW5LxZ:kt0yApDF/pgwy/hBRsjh+xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869108, "uuid": "8947a480-d933-459c-9138-67e2023ec7e7", "value": 308962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869108, "uuid": "ba483093-dc5a-4f23-b5a2-ff1258242b01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869108, "uuid": "e002da49-3c8f-4065-9390-a1161b9b4f91", "value": "SHIPPING DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38293c83-a773-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675834882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834882, "uuid": "f38ea1f4-8b44-44d0-ac5a-b1588ba1d8bd", "comment": "Malware payload (Amadey)", "value": "794ebe18715b31f2c9d3db8c4929ff60", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834882, "uuid": "6f6a7de1-41e3-4b50-a5c4-fdd6e28ef6bc", "comment": "Malware payload (Amadey)", "value": "134deb7b278006bce18fd6035cdb6454a697671be418126a29ace5e29b381998", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834882, "uuid": "7eb2454a-792e-4dbd-b51d-216c89955853", "comment": "Malware payload (Amadey)", "value": "457182c5fe752fe46a163820098accc0e2e0c93c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834882, "uuid": "aa77be1f-33f8-47b5-9df6-44ceac4a10b0", "comment": "Malware payload (Amadey)", "value": "37289d34ca5e720247fb9ceee086260ad8c91b49930a1a02e5265583d24138d90dbe8d2f35e51e5514cd8e03427cb047", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834882, "uuid": "673892c7-6d49-43d3-b3ff-01d36eb8c524", "value": "T1BDC41207F6F89061E4B56B701CF302C30A3A7EA15B74935B664EAD4E18736B0B135B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834882, "uuid": "7642f17a-d890-4c31-ba73-121265067774", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834882, "uuid": "f325e432-7438-4e1a-920f-3da0c823b36c", "value": "12288:yMr/y90sYNJH9CpJMps3UrAJBvgLMyxx+r5JhNuXeXdrp:5yLYNJdCpJ63QJgLtxW5JiXeX1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675834882, "uuid": "40701534-86e5-49c2-9c32-72b0f7a01968", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675834882, "uuid": "fe551bcc-4ce8-4168-b3ae-327c7b0b9f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834882, "uuid": "05402196-7963-4822-ac84-8f76f8c7f33c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8eb95d-a7a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675855294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855294, "uuid": "1e646554-c28c-4d2f-adb3-865cfd042995", "comment": "Malware payload (Amadey)", "value": "b75e08379a38f1a57e17c2eceb1180f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855294, "uuid": "4ec6debd-9e5f-494f-837a-c8b89fa3ad8b", "comment": "Malware payload (Amadey)", "value": "135b64bfa403cd5ea5f9e7b9a1c844e08532a9b18a288b415a3cf3a63c28acf0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855294, "uuid": "6e16fb4e-7345-4840-8081-c36efb095ee1", "comment": "Malware payload (Amadey)", "value": "d16a1004604e2a316d5feb6c25cd0b3638886f0c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855294, "uuid": "1c79abea-46a6-491c-8e0f-342caf3b9239", "comment": "Malware payload (Amadey)", "value": "a002b0da62ab855111302ccb26c971bab07f842ea9aa3d521677c51d2b5f42f8b76e64b522f428319b91cb28ec0dcf54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855294, "uuid": "e34071f1-2144-491b-a464-16b07a3aa1e4", "value": "T1F7C4021BF6EC9472E9F057B149F613C30A72BDB066388397278E6D191C725A0A63533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855294, "uuid": "8cd5d9c6-9207-4df0-8436-d246300237db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855294, "uuid": "02c6de47-e08c-4cc2-a14a-e0d329f24a12", "value": "12288:FMryy903UvT9HtKR4YB/MFVCrp3dMhf23YVEH/pGD/GQ4Y:Hy6U5tVYB/Lrptaf2oVwQGQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855294, "uuid": "065e0dbd-ca44-45e4-a44d-a2aadacc8c53", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855294, "uuid": "0358dc8b-e634-4bf8-8e6d-a2d032f1f6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855294, "uuid": "d8eaf67f-a23a-4bc6-bc2a-f4b495df8015", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacb437f-a788-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675844094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844094, "uuid": "8ed4363d-24de-4f1c-a7e6-a47eb6796158", "comment": "Malware payload (Amadey)", "value": "7b2f0c5506ddb40dda0a49c381ee6155", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844094, "uuid": "9e25eebb-0a2e-4a9d-ace4-b8e444f3a7a5", "comment": "Malware payload (Amadey)", "value": "1381d0bf4f5ef6e25a2fc5c442cd84793ef3fec33dd9d976035016bc1850d6b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844094, "uuid": "b71473ae-9aca-4db9-ab16-4085f1e1a023", "comment": "Malware payload (Amadey)", "value": "2a5a530852e0cad05e0fe498dfa7de6b590b7461", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844094, "uuid": "2a23315a-f510-4495-bfb6-ae02445857a3", "comment": "Malware payload (Amadey)", "value": "0226a4bb9d010112da5dd262dc99a429695af4ed26c477a9704bc313b623aaa09ef8b62329857e924829a6c877cc2456", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844094, "uuid": "9449ac7b-387a-4419-95d7-9f657d51aec6", "value": "T117C40207A2EC8832E8F117704CF647D3173BBD629A74839B624F692908716B1B67176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844094, "uuid": "54546044-521b-485c-8932-c4639d80e985", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844094, "uuid": "4731f444-c926-425d-9dd8-0090fe0499d6", "value": "12288:wMr1y90HcIphFO8WmlIjQDxdPSHuVsLJxzEe7q:VyYcUhFsQIjQ3PPVsLL/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844094, "uuid": "8ba7b365-b024-451c-a13e-ca7f2cc94850", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844094, "uuid": "ed074215-5429-4f55-8805-efd14731b844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844094, "uuid": "51a73ea7-5c7c-447d-80a8-7cc20a635a0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3335a525-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885554, "uuid": "d559c755-b8ad-4d78-b575-d4989d6db22c", "comment": "Malware payload", "value": "a999626dd2cad522806b2e1f61a6ca23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885554, "uuid": "ab9057de-e22a-41cc-98f3-7836f4b51155", "comment": "Malware payload", "value": "140a4592e058401223f012600d3382b6a8925cadf31e50024a3822a195e696a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885554, "uuid": "673ffc68-89de-4bb8-943d-5878d845381b", "comment": "Malware payload", "value": "33be15fb07403e2d8e9034553d35957bcc38afc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885554, "uuid": "8b0620dc-d768-475f-9f70-bf759979a8ed", "comment": "Malware payload", "value": "b21ce95f811fe8cb5557b4d843bbce4b329caaacedffc99737fcd6622ae04b9228bbc448ae4c4c6bc7e68150ac40ea21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885554, "uuid": "ec32ba3d-99e2-4835-a34c-c2a804016414", "value": "T1C1C5127D7145C86DC280BEB4CC3AA9E71CDA6DE3E9E0A42270D97F3F91791848B1911B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885554, "uuid": "39994ed2-fa24-4a78-8e77-52e26dc20949", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885554, "uuid": "99005e5a-03f2-43ec-a8d2-cef78b682ec1", "value": "49152:rdHypdpM1Bw07Ntt1kbx/srlAzEVAiEbG4FL/NiyZSdTopu5ViG7rLCgv2MR:JHyT0JLQCpVsbbFReMuziGjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885554, "uuid": "4b40ec13-08c9-4640-b536-6154685776a5", "value": 2705677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885554, "uuid": "c162045f-07c9-4092-9c31-c270446863ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885554, "uuid": "60dffc46-5d5a-4b62-b565-1415b6f3e626", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284ffa2c-a7b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675863202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863202, "uuid": "e68a1ffe-a5b9-478a-8e01-0f853163b2ff", "comment": "Malware payload (Tofsee)", "value": "01a3c4df7bcd2d3a71c4509c3fd0b2a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863202, "uuid": "5778bed8-7a60-4689-a5f4-691cbb0e59fb", "comment": "Malware payload (Tofsee)", "value": "14a7c5a5c66dc73b5a170f2f43fba2e97c0139fe1456ec56fb5857eb673d973d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863202, "uuid": "b825b6ec-2433-463a-8552-d33c8096513a", "comment": "Malware payload (Tofsee)", "value": "36970dee1e367f341debb313d9182ea6ab9fcfe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863202, "uuid": "7f6a083e-7272-4241-8e90-a7f426acfcbf", "comment": "Malware payload (Tofsee)", "value": "af8a4db4a10530de0f8402d3a96258092275a0181133a9a0c9654378bf463057f70915de21b63fd4d3391c663aecea98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863202, "uuid": "6ad85ed8-0340-4014-b19b-cb13cdf331be", "value": "T1CE643A8397E2FC40E9658B73DE1ECAE8761DBA808F1D77769219BE1F14710B2C263611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863202, "uuid": "67c6f13e-6bb9-42a2-b0e3-c2f4d0a610c5", "value": "2f5b7fed6dc1f658f0b63563ffdd4c3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863202, "uuid": "41b16e6a-f4fb-4c26-a915-b92d1247cb27", "value": "3072:kwUAV7D+B71hJdONp0FX+sKucBOjEtnF5/ESBmO7ARLStKRxhUwscNr:kFA98zTypEOlVwEvESoRgtKBDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863202, "uuid": "9e7c1aa1-22d8-4a3e-98f4-c380640cb638", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863202, "uuid": "42da4187-97e3-40d4-a062-7bf4f66d3958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863202, "uuid": "3359564c-f086-432a-bdc7-af2d9199387d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec843ae1-a7a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675857518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857518, "uuid": "c92af461-1a45-4779-a1fa-3075bf1567e3", "comment": "Malware payload (Amadey)", "value": "02857de039134e49b405c4f9b6b0d39e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857518, "uuid": "74636953-4e11-4e53-a2ae-61fa4708d042", "comment": "Malware payload (Amadey)", "value": "15294d568624ad2dea7b9106452ce816a998c4d1c1a71fac0f00a7cf7634eed6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857518, "uuid": "1e8519f4-7847-479b-b7c6-06b53a776ae7", "comment": "Malware payload (Amadey)", "value": "53954b714441303e75e9b9e99d8117fe647f735a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857518, "uuid": "3a43830e-9736-42aa-9acf-e44f930296b8", "comment": "Malware payload (Amadey)", "value": "87b21a7a9c856d4e4451c4af05abddaf8ddaded5c2848f7dcedea26c2777dad153652a390f3373e1bf32dfc876238e71", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857518, "uuid": "85a92556-4ce7-4029-bf0d-c82233e1967d", "value": "T1B8C4021BB3EC4121E9B5677019FA03D309767DA1693CD387274F6E1B18726A0AA3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857518, "uuid": "851b438e-514a-4522-9959-958fc8d8378a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857518, "uuid": "2f8ca7cb-ad54-411b-bc08-90c2c1576eec", "value": "12288:qMrXy90DfU4wfQ9MVdXoPYodLh42JYQKawT7nrqhS12:dyifHwUeXiYOt42yQHoXZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857518, "uuid": "890d7284-9e4c-4da6-8fdb-747e466b60a7", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857518, "uuid": "72bb9369-3edc-45be-8c08-71cb8e0fd922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857518, "uuid": "4f7544b6-5d10-40e6-a996-b0efb615fae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc56b5f-a786-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675843265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843265, "uuid": "5203c143-2461-4f0f-b7bb-5894cfd0de7d", "comment": "Malware payload (Amadey)", "value": "347d7ace9bd868a1c19b0544380b16e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843265, "uuid": "a31e87ed-f664-44d7-84b7-1e4585dbd35b", "comment": "Malware payload (Amadey)", "value": "1558329708afa5a842c0789f5c5516269f4bdad50e1444abf17ac554826847cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843265, "uuid": "71f2ce66-3fb1-40aa-bfde-be2da1a4a6cb", "comment": "Malware payload (Amadey)", "value": "865fad1a36006ac89deaf425540c75ef06e39b1f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843265, "uuid": "cb1e13fc-0d54-4480-a0ee-585c65a99d04", "comment": "Malware payload (Amadey)", "value": "2b5444b6703b0b3ceb126087ac90b2d2576831713b78450a4193e773af06c8b2952b9e2fc60c3cd16653b4fc7071224b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843265, "uuid": "2c7feca4-0e12-4869-a802-b8b119be8701", "value": "T12BC40207E6ED5462E8B4177019F747D31A37BE919E78839B234B6C5B08722B0B63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843265, "uuid": "894a0ea3-923e-4614-9a0c-79ee15b00694", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843265, "uuid": "9d021165-ad68-48a9-b93b-4ac6ad6870d3", "value": "12288:zMrqy90fNH1RmvbvqElIpQGxdPSxM4v3cS3DqIU:dyGVRmDvq2IpQCPQ/D+IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843265, "uuid": "24581ad4-8edc-444c-95ab-a822c7c59709", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843265, "uuid": "ee86b8eb-d8d6-4300-b92c-16f7dbacfe85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843265, "uuid": "08b5f71c-0eb0-43e7-b444-e0b4369f87ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3e611b-a746-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675815835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815835, "uuid": "60b494db-6f51-4389-b8d4-6d47fca2966e", "comment": "Malware payload", "value": "ae00f928ef26b5cfafd734cd90d95b37", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815835, "uuid": "82299d36-8af2-4313-a50c-501a4488b51c", "comment": "Malware payload", "value": "157753d3c09ff4b7d2ff802ed25474a043019ecaf111893f93eafdca474b6590", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815835, "uuid": "eda1b895-9f94-46fd-be9b-635645aaa97b", "comment": "Malware payload", "value": "3b51e1d256f5bf0224dc80783b20d190d4dc7908", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815835, "uuid": "532e6a1a-3250-4d2c-ad1c-fe1b4fd4f16a", "comment": "Malware payload", "value": "ae48efbcce3a3dba68c8e84e3719a4f7de26daddff1d9b08da345616f22942ae3ffe07d57e6107147b6503bd3f57321a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815835, "uuid": "02b7dd91-546b-490d-891b-6864b8fabc1e", "value": "T1EDD02220A4A9CB061B8EE0CB02408AEAD8742B0870389A106290CA1C220873993072C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815835, "uuid": "5a34c271-7ea0-49b1-ab0a-52c10d82fbc5", "value": "6:VtGTaKq9NiP/Hs80QO0cB1OAuaHpWZBNLPbMHo:Vt2qSPPs80QpcB1OAVWZLQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815835, "uuid": "d9695239-5489-4856-adf7-c9fa580f8466", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815835, "uuid": "7aa03e4f-0004-45c6-9359-3bcc25737599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815835, "uuid": "49d42b9c-d382-4a5d-ab9b-55c9165879ad", "value": "Loader.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaf5a45-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675881010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881010, "uuid": "72942561-6258-4031-86c2-6fca9f9fab31", "comment": "Malware payload (Smoke Loader)", "value": "197878f44a5a771680a02dde0a2ecfa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881010, "uuid": "fbc30df1-4432-4323-b39a-80c4de9f4636", "comment": "Malware payload (Smoke Loader)", "value": "15c5c832b28cd8fced64386cb021d28223a08c8ded248dd13863abfd2974b06e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881010, "uuid": "ad589fec-9fd1-41bd-87d6-546201cc59d5", "comment": "Malware payload (Smoke Loader)", "value": "97150aef0c1359e913e7542818fb28178be49bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881010, "uuid": "0404aac3-8441-4cba-994d-f7869b4f1845", "comment": "Malware payload (Smoke Loader)", "value": "3aa811b7ada8c411f2663002bcb0077578707337b6914899a272a4fc7bdce575607368d4d2d337570671cda0fd7c1833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881010, "uuid": "72028e17-9956-4120-aac4-0e2b32443d78", "value": "T1C5641943D2E27D80FA258B769E1FFBE8765DF5708E4AB7653218EA1B14F0172C263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881010, "uuid": "04b621d7-b27d-4857-84a1-3a2d8c3a714a", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881010, "uuid": "756af9d8-9e14-4f96-a84d-a6ee7532a581", "value": "3072:pPg8SK2yzxR9z0yR579koDIH9vOa1L6BjF4B2sWQDiuLpN2yvJ:pvyy5z15GoMHopBcjLiqkyvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881010, "uuid": "af3276d7-dbbb-4225-9621-177602dc6453", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881010, "uuid": "5d3bd29f-f77a-4023-8237-d63fc3410107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881010, "uuid": "9f165695-5b6c-4ad8-b2ec-b7a2ef83ce92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dc26ab-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881556, "uuid": "06ae355e-28d6-4454-8d8c-70d52e02132e", "comment": "Malware payload (GuLoader)", "value": "2b5ab50d62a83323b1a116aa971a68bb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881556, "uuid": "c16b969c-8d2b-43b0-9e0b-6f840f95e979", "comment": "Malware payload (GuLoader)", "value": "1630e7ed4231aa7e175b188202686e4402d447cf6aeee2397deac02aae5f9702", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881556, "uuid": "2d9ff039-2a11-4177-8011-25957caebbd0", "comment": "Malware payload (GuLoader)", "value": "70be9ff6c13225a4d063e80573edf155d6bc4696", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881556, "uuid": "8bfdd48d-4159-4b86-b1c0-78ec928c4644", "comment": "Malware payload (GuLoader)", "value": "82713a53429934fc58c17bfced6167da0013a4abd7217a579746a2b1af830e869136399a413948a7034ac7d73ef3ae57", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881556, "uuid": "8fceac53-25cc-4042-8a03-4b52f5339e8d", "value": "T1009402B09E18DB5CAD0DAF7D9C190D5FCD210CAB7B0FA76ABEA011541213A7D966F308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881556, "uuid": "e86797c4-3578-451a-b1b2-04b5f0c1b756", "value": "6144:KX0/Cp51RQewTGd2IwtnsJ2xNHTJpump7CF9gl44wVIuUV5EQGnG15UtGazMyNk:KX0/CP1KNTGIxbJpui7eB5ICQ91WRjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881556, "uuid": "59880d3e-d5d3-4c87-a22f-315c4d7988b3", "value": 426912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881556, "uuid": "5bad759e-c94c-45ed-b5b5-b4757a64acc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881556, "uuid": "f1d35b21-5d31-457c-94bd-e5bd7745f51c", "value": "SAMPLE & SPECIFICATIONS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4d3a3e-a7c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675871450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871450, "uuid": "321f2833-25aa-4858-a3fe-c6be7f1f6b49", "comment": "Malware payload (AgentTesla)", "value": "8686414309a50f3d17edcc2bf924d7b2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871450, "uuid": "621d33b6-57c8-48f6-9834-d341f97e29e5", "comment": "Malware payload (AgentTesla)", "value": "167a00c847715493cc7da88c373491dfda4b669c480ec0a529e1363c770c4f52", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871450, "uuid": "b28bd88d-df27-4ddd-a99e-db4287194e8d", "comment": "Malware payload (AgentTesla)", "value": "41c9daeb2dd4cffee750c3b5f9265695a6029716", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871450, "uuid": "4b1e0801-aba4-4148-87d9-42be4b9767b9", "comment": "Malware payload (AgentTesla)", "value": "1b32c6c6ed7d37eed1572ebee0c9894a2a4cecad018f3d9bc8a6edc5c095c317337ad9da5ab4f99037413bc8bfa0e6fa", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871450, "uuid": "4a6945aa-23a7-4497-9db6-f6013db36fc8", "value": "T1FBC4234D8F978B56D2BB5FF36069833F74AC880EF5E941889485BED3140BAF7728051A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871450, "uuid": "d09189c3-932a-4140-93cb-d5fd4b22324e", "value": "12288:MghScprZdo4WlW3N1JXd+q6C3Rpq4G4GtMZFTNS/2w9pjqKv9:MgdYM3N11dH6YpqZ4GtCTN69p2+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871450, "uuid": "5f0f22fe-885a-4c2e-a618-4b1c915eb8bc", "value": 548515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871450, "uuid": "2f6178d6-014f-4a03-b692-ea0dcc626bb0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871450, "uuid": "cd3d1780-5747-47dc-8fa6-a0c0720f322c", "value": "Invoices with incorrect prices.pdf.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f656efaa-a7d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675878580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878580, "uuid": "24fc8872-5f94-4360-ab4b-342f102a76d3", "comment": "Malware payload (Smoke Loader)", "value": "1d50d943849bb6ed79272bc2549db810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878580, "uuid": "0e2a1871-3321-4c4e-819e-b1e0c4461b94", "comment": "Malware payload (Smoke Loader)", "value": "168e47767e7013f254e3abb232e279eb43b743438820633a4ecbe52cac4e9ae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878580, "uuid": "f13bf05f-a9e8-4332-a651-751f1cd2033c", "comment": "Malware payload (Smoke Loader)", "value": "845e2b3163d367781caa86034a73118e6f184da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878580, "uuid": "ffc7c8cb-b2ff-4cf7-88a8-7418234eaa64", "comment": "Malware payload (Smoke Loader)", "value": "ce09291e1fde5db0842cea58b9efd0269b319d9f53dfbe6170ad28d3ce5ded452d8127e23ffa3fbc115f0cacab65b064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878580, "uuid": "707ebca2-36c7-4237-97a5-5c44496d07db", "value": "T16F642943D2D17C80F9668B7A9E1FFBF8765DF6608E4AB7653218EA1B18F0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878580, "uuid": "9a5f4a17-cf16-4100-a61d-1ddfd1af27ca", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878580, "uuid": "f20e3e66-bc6f-4699-82d9-aa6b66b1f91f", "value": "3072:3PgogOc/rr43qdxR9jAvpzCboAXvfsWQDiuLpov:3GLrjZoAX8Liqov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675878580, "uuid": "55425dc0-42af-4d74-8bc5-af0add7449da", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675878580, "uuid": "0cb929e5-94a8-4fde-9641-7971ed3aae7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878580, "uuid": "c51a128a-08b2-4d70-a300-ea4977a2401d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fa3274-a7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675879358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879358, "uuid": "5eb9d0af-b8c5-40f0-ae0c-3499409947c8", "comment": "Malware payload (GCleaner)", "value": "ee84d71222a3082e8665edaef8fa030d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879358, "uuid": "20195764-c742-4074-93d8-77cbd985a277", "comment": "Malware payload (GCleaner)", "value": "16b17e50998f05875c02a58dfbd637786c7a4c5b0f1b489d0bd9646792075625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879358, "uuid": "68c10c61-1457-4941-ba59-8e72ec44587e", "comment": "Malware payload (GCleaner)", "value": "6446070123cb5fbe597e7f05377893fabefaf56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879358, "uuid": "d5632858-eaa1-4078-aa3d-eb4c3a73497f", "comment": "Malware payload (GCleaner)", "value": "faf333ac391c59c6f288f6717f0077833cf432ca99c5ad904f6c1c99c7f5effb767f784e43cc0e95a753ea95fa4e8eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879358, "uuid": "6383410a-9393-44b3-abb0-c9cdff27bbdd", "value": "T184C5123C7105C4ADC290BEB48D2AD8E75CE72DE3E9E4916230DDBF3E927D1896A09147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879358, "uuid": "da386c3e-8256-4777-844a-444f0997f007", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879358, "uuid": "21b84783-6a56-471a-b839-e408546e1107", "value": "49152:rdH9Gj7ArQDgdUVmM6pXfTCigB52/YeXMVzNV/LCgv2MR:JHMj8+Tqu52/Ye+bv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675879358, "uuid": "5f74510a-9a6f-4bc6-8b44-6ec7ffdd229d", "value": 2684546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675879358, "uuid": "41a2fb44-2df0-4f23-99a4-d097a41079d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879358, "uuid": "2b5fcc13-35c7-483d-a2ce-04cd1aa74181", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ef1d4d-a787-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675843381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843381, "uuid": "d71dfd2b-77e9-4483-89c7-0b744442ad5c", "comment": "Malware payload", "value": "dda865f7b39025084c644456f939d58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843381, "uuid": "249d98df-bd2a-4055-872a-5d94094ec118", "comment": "Malware payload", "value": "172092055406e46c80f319944f4aba3b2ce959216ad51b562e1a07864754e2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843381, "uuid": "512cba0b-5eaf-446c-b626-8b70b0676e7c", "comment": "Malware payload", "value": "ef552f654002f5e62ee5d182c5cd56891f5e41a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843381, "uuid": "b0019e4b-023d-4bc2-a313-d0985be972cc", "comment": "Malware payload", "value": "263d85789947d8cd4ebaa731c4d477b305aa1029c2031ddaf0d30f826a30146b3f2a00b318436283e32dda1b2d23f41f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843381, "uuid": "b4ce578d-eec5-443c-b03a-f9208a40b13f", "value": "T196468D02E791C176F9A320B659BE576E643CAF301B05A4C7E3C82E5D4A712E27A37353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843381, "uuid": "48e6e957-3f1f-47c6-972e-4080702c752f", "value": "bef16836f96a3b0662eea953044ec7fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843381, "uuid": "d463b0ee-abd3-4ffc-a975-16eaaa312e2e", "value": "98304:5Z97tvKCQjMxht7WjhlNNkJk9We2WGOoiImVXwOIape2uByTrY9zej0:5Z9N36jhnaJhjOoiIULcyY9zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843381, "uuid": "bf4376b5-7e24-46a5-8ca0-b0e48c7e37c6", "value": 5421206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843381, "uuid": "d7e6ced3-2d06-4eeb-a988-7b64df77a898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843381, "uuid": "c6e41f0a-c780-46f6-9a93-1e73c052c0a0", "value": "DAT134.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd331d8-a751-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675820554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820554, "uuid": "732c7ee4-84b6-498c-a4ac-1a1c0e593c52", "comment": "Malware payload", "value": "0ba3a8f13fbd53774131724e11341ac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820554, "uuid": "744a356c-64b9-4517-999c-692a64ff45d0", "comment": "Malware payload", "value": "177db5b2d521b72655a864b333e78be1cc7cdd644084cd6b6e5a29bcbc6941a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820554, "uuid": "639f38f9-e18f-46c4-9ad4-ad75b748ddfa", "comment": "Malware payload", "value": "b260134b6a48d775636252f8162147345f543af1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820554, "uuid": "351022c1-2101-4985-860b-b956c12079a0", "comment": "Malware payload", "value": "7825bc4bf72ffdbe8bca0f8dcf9aa879ee693ccd717977b56a54f778231457133415c937abf240b018eccfd321403556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820554, "uuid": "590ff68f-f6ad-436a-a6a6-47dbc03ed5d7", "value": "T118764B07F85190E8C1AED230C66692A3BA717C854B3027D73B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820554, "uuid": "4de7a8a1-b447-4a35-93d2-6eb4b5726219", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820554, "uuid": "0ed08552-9348-45f5-8ef5-96f8bc27b69e", "value": "49152:J+7twQAuXA76rb/ThvO90d7HjmAFd4A64nsfJQpv0z1ZxMDh6pxW7o4M3J3j6rT/:+VEtq6Z5M4XvpECAzkT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675820554, "uuid": "8f9125bd-babe-4ed3-b563-84bf083122af", "value": 7806464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675820554, "uuid": "5d2bf2a1-0ad6-4205-9a4f-1615a5561407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820554, "uuid": "c9db2d1f-e755-4f69-87ff-fe6e1511cb59", "value": "13184707059883545055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695024b3-a7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675869754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869754, "uuid": "f297de47-c81f-4d8e-87d9-255697962ddb", "comment": "Malware payload (AgentTesla)", "value": "5ed49e80a2bd9e75bfb4a6fad636c7a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869754, "uuid": "a6c0b276-2f89-4e83-a18f-79562709e480", "comment": "Malware payload (AgentTesla)", "value": "17e4e777cf7db066c6a344d5b36610d4124068bbfe4dd23cadcbbc7582805048", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869754, "uuid": "f8099daf-ca57-4f57-ab68-0482319d5252", "comment": "Malware payload (AgentTesla)", "value": "cf7d036ba72e1f3f19e9abc9beb17dcf144efc15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869754, "uuid": "90786f36-e28d-4953-8205-056b2d81f55e", "comment": "Malware payload (AgentTesla)", "value": "73c199125d12360c916dd2b38e07894d64f62c41a00b4347d6c92c891bafe34396b420031c42120611539bf39a2e440a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869754, "uuid": "3b619f42-e046-48a0-9192-f7107b4a6997", "value": "T17B2512917128CBA0E56907BCD9B08AF013766EB6E964EFD77CC27DDE3A31B514040AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869754, "uuid": "4613d597-7b81-4b54-90c0-5d1af3170a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869754, "uuid": "9b3e2b74-ca0f-4f45-b01f-5b8c9fbd48d5", "value": "24576:21bgzPGhgzfYxwMYe0gxfZUbctKTb31l/TBcS:2ZyPyywxwMYeVxisKTbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869754, "uuid": "45f33b34-d876-4fe0-8f63-4f328a4e2b4d", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869754, "uuid": "c4194ae0-13af-4192-b250-788101eb7bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869754, "uuid": "ede4fab3-a696-423c-a0f8-43f8b1ec56c7", "value": "AWB NO. 1456977583.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8439b50-a797-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675850532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850532, "uuid": "adfa767e-5a85-4877-8eac-c708103ab83e", "comment": "Malware payload (Smoke Loader)", "value": "8edc0cb843353bb3925fb34150c2b445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850532, "uuid": "088c4474-214b-4e25-9d89-e012f0dd3143", "comment": "Malware payload (Smoke Loader)", "value": "1823faf4751a3fe3c0d806cf7f744353bcad6d481b915a5111508630292235ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850532, "uuid": "3b111777-3712-4121-878b-656a535c6f70", "comment": "Malware payload (Smoke Loader)", "value": "d94278053e9dd7268ac2d381434d8b0c44885ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850532, "uuid": "1b227ea0-b028-4467-9e00-985041e16bf7", "comment": "Malware payload (Smoke Loader)", "value": "6042f0e8766cb1aec2303e22593735ceefb5d6bb2d6f2d4787d293ca5ba5b08b9e6ba57cf11045a3b8803f90755d1d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850532, "uuid": "88cfe026-d399-460d-863a-becf2416d894", "value": "T10D644B53A3D17C48E92ACB77DE1EC6E8F60DF950EE4A3B693218BA5F1870072C563215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850532, "uuid": "7b04a8fe-1e33-465d-9428-b8eebdc2e22a", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850532, "uuid": "9a68b1c7-e36d-4c94-9fcb-3480d7f884ac", "value": "3072:7waqHuPXtwXR5PU+5Ntmq67nHKCPGGa08w4qf9uytWByUAl1uNBW2:73UW9UPUMiKCPwlwfVltWUjuNI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850532, "uuid": "f11ece74-119e-4ba9-b935-454e4026a27b", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850532, "uuid": "5bb965b8-04c8-4d3d-80ea-832c896def12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850532, "uuid": "6d9b1eb4-d2fc-4fc5-bee2-66407959c88a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591edd93-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880893, "uuid": "2db0ada2-f3ee-481a-bf0e-a8a5b29e75b9", "comment": "Malware payload (SnakeKeylogger)", "value": "d96ed0532a32d631cefbce9964face15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880893, "uuid": "64150e3e-f54e-49c1-afbf-a66e058dd1de", "comment": "Malware payload (SnakeKeylogger)", "value": "1850ad31c0e82acbdb32564bbde5970d5a1f9d56d35ab8bb142b4fe17fcd19eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880893, "uuid": "ef3b618b-e086-4ce2-96c4-5681e9fd5d2c", "comment": "Malware payload (SnakeKeylogger)", "value": "3602012b67f2e9b53f4fb56c79c1974193f2aa4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880893, "uuid": "22d5dcac-fe6b-436c-9fbd-9f0b68e18154", "comment": "Malware payload (SnakeKeylogger)", "value": "3a248637fbd4486c46b0e2421c40eb813293118ad029c5091def098b3d5490ec96c71a6db0cf8af0041598c7c68b295c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880893, "uuid": "013925a1-7a88-438c-9398-f59d38a5244e", "value": "T1E635B62439EE501EF2B3AF799EE4358B9EAFFA73760694492054034A0B13B41DDD253B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880893, "uuid": "c9bc6431-10f6-4526-b932-bb16c059a300", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880893, "uuid": "3e2c4706-0205-4c86-b91f-1b52fe1018b8", "value": "12288:EN1MXcgVqpn9+Z4cSbEX7ULxMtLcfUjw0cOm/kArW1Yz8cVPIt2ZBYYCU4p:C1MjVqpn9+Z4h0uLlVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880893, "uuid": "9b1a84d9-fa3b-4900-98c6-56bb29543a17", "value": 1148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880893, "uuid": "1995f655-5a36-405f-ba94-d1569c76f742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880893, "uuid": "ca9b6c04-f451-4daf-a0d1-50cf5af6f66f", "value": "PO 00292002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e225e0-a7ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675865540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865540, "uuid": "97179773-baa0-4ab7-b689-c00f1b56aa65", "comment": "Malware payload (RemcosRAT)", "value": "68c1231d6cdf8726e0e903b96caa47a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865540, "uuid": "c0a8cb9e-0108-49d2-8730-2330ff7fdcd4", "comment": "Malware payload (RemcosRAT)", "value": "186f0d4f01e510e5f09833366eb78f32542c8614a74d9101a927b0970fde4937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865540, "uuid": "ecb851a1-3725-47f9-9674-8a63ebdf778f", "comment": "Malware payload (RemcosRAT)", "value": "318082f1eea34e7ebc91647e6ea5338a6ce67e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865540, "uuid": "13eca059-9071-4fac-b2cd-329ccbd604b5", "comment": "Malware payload (RemcosRAT)", "value": "2e11a9e545c83fd51a8008175990a94b72b4bde5374fc9a4b172fda7954a5a756576e3c17dd6ef90f0f62f261fc51b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865540, "uuid": "1ba1b628-0170-4961-918e-38ed2e118f72", "value": "T12FB42358EEB1B1A7D01907714DBB507A7BA2BA1568AA135703E04F1A7C21FC3DB0F35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865540, "uuid": "b58f2bd1-b3ad-4890-a93d-d1972e3b6624", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865540, "uuid": "b9fa9ff2-d4bb-4a97-96be-0c5db170f468", "value": "12288:PY+ft5hFc2ijd1QDrmPKvqxuovZ+Nes2Ys9xvRrgdy:PY+15h22Yd1YmXJvZ+Nejf9xaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865540, "uuid": "2fcbc0eb-9d4c-41f3-ae3a-94f09add05f8", "value": 532920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865540, "uuid": "e2fb739b-9666-4b25-81d4-16a85d1ed1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865540, "uuid": "bf625dad-70ed-4d03-8985-678407d25ee8", "value": "SHIPPING ADVICE DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44830635-a76f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675833185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833185, "uuid": "1aef2675-6cb5-4376-8686-f0990072ad08", "comment": "Malware payload (Amadey)", "value": "547605511701c1c5ebdd75c9edc173f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833185, "uuid": "00984ade-2b6c-403e-aa8a-8170edd5c556", "comment": "Malware payload (Amadey)", "value": "18994931a0b5d8b772b45bcee31084f4a9ed9ff11bd2d723a0a46bf6ff7d85ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833185, "uuid": "58498ed3-f149-4afb-b8dd-25a40513c563", "comment": "Malware payload (Amadey)", "value": "f0c6312cd88f773bd23033c0f00fc5608e71d738", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833185, "uuid": "00eb7bf1-7d47-47f5-9771-ab41f9b50eeb", "comment": "Malware payload (Amadey)", "value": "ac7f485e4c6aa0973aee937400195b059b0e4ecaa5c30d099e600e9d4d1c87e36357fc979edf07d508eb0bdce3508cb3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833185, "uuid": "b1c90ed2-ee1f-4fd5-a128-57e807e76015", "value": "T1BFB4011BA7D88176D8B16B7018FB03D31A367E719A788257234F6C5B1C722B0A63173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833185, "uuid": "79b1134d-d4b3-4da3-8dac-20d34502feea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833185, "uuid": "23125e54-344d-4137-8c2b-9154ffde1505", "value": "12288:sMr3y90Ur8yVL05DrgyJazx1H99r14f1O1jjK4mD3QTXXLDrj8:Dy0ydADLwHnU1O1S4mDATHH38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675833185, "uuid": "5b2fc799-2972-400e-8864-b540cbc92e13", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675833185, "uuid": "4866a7bb-faca-4ee6-b0f8-3582d953e8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833185, "uuid": "7cf9056b-959f-4635-8db6-7b15c2576330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17041678-a79e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675853295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853295, "uuid": "c8cd04a7-f072-4c77-ba2f-283e50f3b279", "comment": "Malware payload (Amadey)", "value": "23744ae4b3d6555df301809f10fe2678", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853295, "uuid": "a3b01bcc-b17c-49c3-9b87-4e05f46dc998", "comment": "Malware payload (Amadey)", "value": "19e5794cb78a57f1c11b18b308abc7868dd1ee7a5171335606bbfae03016829e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853295, "uuid": "ffbf9080-f18b-4b85-9aa9-2b655abba0a0", "comment": "Malware payload (Amadey)", "value": "b6bac789e56d8d889d2d2483395c8a68a9357863", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853295, "uuid": "f3771069-98bf-41b2-b165-f06934e267da", "comment": "Malware payload (Amadey)", "value": "56f0e37243ea256b0f15f8338660f47d57d7d724e2014df1fe4e7a257fd01d53836043e7ebc100a87890a523e8554eee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853295, "uuid": "818e48b8-f4d1-41ac-b749-01fb45e63e9c", "value": "T14EC4020BF6EC5136D8B117701AF602C31A3A7E615A38C3DB130E6D6A1D722A4E779727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853295, "uuid": "18173b7c-ed7c-4bfa-a9b7-6babf17e12b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853295, "uuid": "69e546ee-6b06-4bd6-9d4a-cca505b42d99", "value": "12288:lMrCy90pyOlLjvX7NxCxPFY6Su1zxAFeJjDs5Q0QrnhQUY:3y+v9z7kdYYzqejKQ/Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853295, "uuid": "3283ad38-a7f4-46d7-a50c-8021aba8f70a", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853295, "uuid": "54e0e688-3c9a-4622-a121-9cacc5d048a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853295, "uuid": "9bf4bcc6-9625-4e07-b500-ebb6c2cde9ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fa1712-a7eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886425, "uuid": "0ca8ac2b-ebc0-42ec-a803-83011d81a399", "comment": "Malware payload", "value": "4cfaeb19a7c1b2640bbee4bde93cf743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886425, "uuid": "660b7516-c94a-4a7e-9077-f99972b1581a", "comment": "Malware payload", "value": "1a4252711ca5b3cdf6b112ddee48d7fe02db59ca89e0f6f583ea8e747465e7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886425, "uuid": "71743a77-866f-4f3d-9922-5d79e1d6f235", "comment": "Malware payload", "value": "c06c85073611ab3dda8fc31e4717809179dfd88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886425, "uuid": "2cfd8213-c02d-48ea-a0c4-0f5b49d9501e", "comment": "Malware payload", "value": "229f8f32dfadd02bde92ea7f907ffdb8fa36c13b8c87d33f2f2eadc922f1008dc6963e4b1ff5c8f9abe11097718c786e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886425, "uuid": "d872cb15-6045-4bc8-8b28-1a2e9b15cf9d", "value": "T188C40217B7ED5032E4F5277018F603C71A337EA52B38969B138BAD5A0DB25A0723536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886425, "uuid": "c5073d98-23bb-4e9a-aa01-23d729339125", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886425, "uuid": "86368471-e607-4697-adcb-54674151d30c", "value": "12288:9MrIy90phfP7VWOHeTMGc/iMykWO2r/+hdn4sQxgK5:9ycfDVT01VLpr/EasQ15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886425, "uuid": "d0970eab-830b-4f0c-baf4-f99dd76d61cb", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886425, "uuid": "f2f2ed68-c491-4530-a165-6211c2f451a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886425, "uuid": "9a3860f1-1ffa-4e6a-aa5b-56a13f96db1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e61528-a79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1675851652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851652, "uuid": "ef506007-4741-4b50-a441-58e7a8405691", "comment": "Malware payload (EternityStealer)", "value": "6b706c27af192877a7a5c18e5d5333ed", "object_relation": "md5", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851652, "uuid": "b12b32ad-2c5e-4507-bd7d-ea24e8f9855a", "comment": "Malware payload (EternityStealer)", "value": "1aa3321c7e05114a5e58a78fdd743d46e32b09769ee53b487bd0c3a6193386e3", "object_relation": "sha256", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851652, "uuid": "f712e373-bc89-47ac-8791-f7a9c3d6f5fe", "comment": "Malware payload (EternityStealer)", "value": "9e495be0251a70a66b2aa9d1343894662e0870da", "object_relation": "sha1", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851652, "uuid": "a6efcb04-07ff-49bf-9e89-6845563973c4", "comment": "Malware payload (EternityStealer)", "value": "41ecf807645a5ff84181cf0787109abad0de25133519d9f603c1ab60262e9b1131c729cd14f52c408501199cd017cf54", "object_relation": "sha3-384", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851652, "uuid": "b4f9a178-ce9d-46ad-8286-ea939d3248b6", "value": "T16CA4D7B313636DDF5A3A0F08F1541A504CFABCAB726D82A87BC519D149E1058AFF4EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851652, "uuid": "cb0956e3-7a47-4906-b94b-61aa0ef73977", "value": "6144:nF6Fv7Z2YncQOPd6sb38ZCpzCC5vrBEtRqG22BgA7EDfXDcmW7EFUBB:nFSncQMb8MwoNEtgG22BgA4bzcmOlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675851652, "uuid": "842ae691-ae36-4321-969b-b8866f038625", "value": 459013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675851652, "uuid": "23a45357-f52c-4b95-911b-33bf46e0599a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851652, "uuid": "0cf0ad05-04cf-41b3-9d4e-96b8bfbc5344", "value": "INVOICE-7141.JPEG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aff9b72-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675855878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855878, "uuid": "6f61a547-e196-4742-a254-05c87b555c15", "comment": "Malware payload (GCleaner)", "value": "d6a1c2f03d9646621fefa485271475ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855878, "uuid": "ebe428ee-2a3a-463f-a3ba-b838eff860c7", "comment": "Malware payload (GCleaner)", "value": "1aa944515ebf7384141869f0b9675d31b10c9f69c2f6a259e1457d10aedf3e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855878, "uuid": "c993e14a-74ef-42f3-b775-11ab24b1c028", "comment": "Malware payload (GCleaner)", "value": "dbc5117eb1f54ce23d500a8bdcf279fb8f037118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855878, "uuid": "f2d17e9f-5056-41b1-967c-7424e38ca65f", "comment": "Malware payload (GCleaner)", "value": "d7abee85c49c759ac5e3d8105c2e00d7b58d209b530f17c8d12f61c8b513fe9e754a5371aaab10310d36810aa4acfceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855878, "uuid": "c4c444a0-b8a8-42a4-9a56-1ea6f0f68c24", "value": "T181C5127CB145C96DC180FDB8882A94E75CD76EE3E9E4A11270DDBF3F81B92859B0A503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855878, "uuid": "af4cfd6e-c298-48a7-8075-5d5cac06e051", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855878, "uuid": "3deae022-9e12-4693-a438-f3e9c48afeea", "value": "49152:rdHd84LXQ8uOpGTtilcyUye8GSjPP5W4JkrNIEIbovGg8TRKnQ7dT0LCgv2MR:JHdXQ8zYglwVSjPP5WG+NIE1vEtwsavV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855878, "uuid": "f877dc3b-1529-4c7c-9621-03a3b757b3b1", "value": 2734051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855878, "uuid": "86d53ea5-174d-411b-b7e8-157b7e9b4097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855878, "uuid": "547a359c-ce2f-4f4d-bc87-da1bbfe926dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcccaa0-a7da-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675879260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879260, "uuid": "b6820810-02c6-4ecd-90ee-8116e533b064", "comment": "Malware payload (RedLineStealer)", "value": "87595e3884ec958a4fcf472a73a7df02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879260, "uuid": "61c35a8e-f8f1-451e-b633-f0a92de6fd6b", "comment": "Malware payload (RedLineStealer)", "value": "1acea8a2818d94fb4bad8f8ff1755f7e53984bcdcec8a6a71989d3b34a4289a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879260, "uuid": "384fb88a-6ce4-46d9-949f-0dca9bd20f42", "comment": "Malware payload (RedLineStealer)", "value": "8da2ab6b6e1f15738155e672f1af649aec52a9dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879260, "uuid": "44a6918e-d809-4f30-adeb-b495843b05c7", "comment": "Malware payload (RedLineStealer)", "value": "8166828900a1cbcda6564a605afc1c43078275741c2beaec1d6f738c582e5001540f723670fc52103dd7694004103a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879260, "uuid": "6725287f-20f6-435e-a69b-bdd981244019", "value": "T1BEC4021BE6E88536E9F457B00DF206D31A35BE516B3446DB334F9C5A18B21A0B1363B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879260, "uuid": "38fe7a55-e27c-4f7f-be17-f45e2d266b26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879260, "uuid": "57502d29-3165-451e-b690-7b01d392abe0", "value": "12288:zMrry90AwjQiJGb0feMhTHl4tOW/BjadeKK9ibAdf5:syXKQ0HeM12IW8eKei0df5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675879260, "uuid": "9e34eec0-f13b-46e0-9eda-15868efed08c", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675879260, "uuid": "ba5bb69b-498f-4b7d-8840-1078d8deec1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879260, "uuid": "9c146292-9432-4be7-945c-00c5999dc759", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abf776e-a7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675858160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858160, "uuid": "b92185b5-ae8f-4045-b13c-a4365c35d06a", "comment": "Malware payload", "value": "443844ac927a2e4e7c976b16dd17aa84", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858160, "uuid": "b39c909b-16b7-4561-b3e6-eba8a810502f", "comment": "Malware payload", "value": "1acfea4218390a872b340873b71343f6d360b5b9a9e300534e59a69fb4d9b924", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858160, "uuid": "0e3a6763-1ab8-46e1-bc25-b307bfa447fd", "comment": "Malware payload", "value": "e4ecb4d2770d243fe770e4ed9ed30fef068c3e35", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858160, "uuid": "516bdac9-49a8-4c30-8915-5d88774c5783", "comment": "Malware payload", "value": "e43bf7e80cb9fcf9605b6f98d15f8c4e37cd9e87b7fac7f57fbbe79d843da5583c4e3dd845ded5e9e2a606c66c42d6e7", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858160, "uuid": "4706f60b-96cf-4edc-aaf5-19844914ca3a", "value": "T15463D029F393116AC2E48D354C477A6CB0005C9DA52312CFA6DE26CD9FB9391CBD0A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858160, "uuid": "4583fc14-0ed6-42cc-aa73-2fc7e8393587", "value": "1536:UBghlxU7TIvSS3gFj0MNIhU0xt5mfyCGTfEgJ8:PjafIxQ5QU0t5mapffJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858160, "uuid": "aee51e8a-5500-45f8-acb2-ff6d27d2caa9", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858160, "uuid": "a01e791e-9ad0-4945-a088-94198c3a81d8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858160, "uuid": "4e950acc-bbbe-43a9-8951-fe0a01b2ce50", "value": "Invoice_0942613.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a696a4c3-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675881453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881453, "uuid": "9a068aa5-a30e-4847-b6ac-30f48aa0d0c2", "comment": "Malware payload (Mekotio)", "value": "670ce706b13ae40fa69ec13a469fd073", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881453, "uuid": "fefd6649-5018-4c62-ab37-be5991a79f8c", "comment": "Malware payload (Mekotio)", "value": "1b03271fa38e387e660eba264e876fe66f37a66e379958af82ff66e2970f1208", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881453, "uuid": "06c729dd-74da-48d3-ad23-b803e6a02021", "comment": "Malware payload (Mekotio)", "value": "13da05b382ca2c6363fbad6ab6b5866599c2d87e", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881453, "uuid": "c6eea53b-b47e-4b00-a2ba-91c111cb0e72", "comment": "Malware payload (Mekotio)", "value": "eff780152974b4702f76b5c037566aa5ed7f0a4290cb1ddce5e478eae1579549e5629723b51f158ce1b18447e21adf0a", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881453, "uuid": "5f513018-c8dc-440a-8269-578018ee77d5", "value": "T1AD56132372E68239C4EA85740A37BFEE39B6572947A198FB51C82DCD35725E06332D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881453, "uuid": "0793ee26-2a21-432b-8111-31cfd54ff49f", "value": "98304:8w1+jtNWmLBMaa7ALxAv0XbcgtcwR8w0KedLc4mVYZcRVM0nKFRUGpnYetMEAG:8O+/1aktAv0XggtcwR8wzedLToRRKlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881453, "uuid": "c53cedc2-53dd-4866-957a-12829774d098", "value": 6003712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881453, "uuid": "dee5ccfd-5c84-4527-ad13-8622c3679087", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881453, "uuid": "0678902b-3fd5-4044-8af8-a7413c3388f6", "value": "Factura6397f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca5d3fe-a7be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675867424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867424, "uuid": "d7352c43-50ea-470c-9a96-59d6ef066e92", "comment": "Malware payload (Amadey)", "value": "34f679dcb735feb2233d717cf18f1902", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867424, "uuid": "39052fa4-73fc-4ff7-aa5b-13f710e26f8d", "comment": "Malware payload (Amadey)", "value": "1bcbaa6c9d870d1dd82ef226a794a78fa7a3186e0318d823ca2799cfdc2c2ef3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867424, "uuid": "bd86fc5d-a4c3-4604-afec-0173f210ff7c", "comment": "Malware payload (Amadey)", "value": "2ee420c152cff1cf2964e461d9f69345d347c787", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867424, "uuid": "7d2fb0ee-16ad-417f-875a-4734fd6425e2", "comment": "Malware payload (Amadey)", "value": "837a0788f207736abadf8cbfe0ce0e485e264edc46a77e9175df8bac1c270e03a7522d2110c177f5956390dc29458433", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867424, "uuid": "eb264f6e-f7eb-440b-818c-084afb843a97", "value": "T1DEC41207F3FC8426E864AB700AF703D31936BD91573583DF624E6C5A18B22B4A67136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867424, "uuid": "50df15ec-df4a-4617-bff9-8c0c6b159f12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867424, "uuid": "79e76e4a-ac79-41c9-8f98-60c68e7fab5c", "value": "12288:nMrRy90cTpY5KV+4DgSC31oG0HGXqoQWdw7xCur4nio:ay7mUVESC3u6qoQWdeub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867424, "uuid": "c82e2c02-8501-40fb-b854-b2fbf42475ee", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867424, "uuid": "bb12a53d-f382-4619-b254-0337b8f7c3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867424, "uuid": "a8f502c5-faab-4e9d-a4ee-84dbe366e129", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515cb210-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675855969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855969, "uuid": "b694bd32-95b8-459f-b04a-883ec23707d1", "comment": "Malware payload (Formbook)", "value": "1671739b7061eae33d9603cf5e213207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855969, "uuid": "82d8a3f4-b6b9-4e2e-9010-a951477ab9fa", "comment": "Malware payload (Formbook)", "value": "1bdc70b47e7a3cfd638eca937ad2117c53ac6cf9fe042cd46fcbc9971d06504f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855969, "uuid": "8e4b5b0d-4301-4d16-8622-4e1eb0941e4a", "comment": "Malware payload (Formbook)", "value": "00eda59ab9ff4c9358a5b0dc0abdac7b4a2b1c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855969, "uuid": "45c4338d-5fa0-49ec-8ca6-bd8bae3fa2a5", "comment": "Malware payload (Formbook)", "value": "bda10bf93814564099d26070469fbd8251f94b570f131580c6cc344cad9c0b46ae854ae7526354cde1966beee6b7af89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855969, "uuid": "263feebc-04e0-4482-b941-179cd5e24b89", "value": "T18FE4F1812D64C619E2FA1FBC1B6C5A2D8BB01D8D23E3E3B50FF2B4D9A5637838415572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855969, "uuid": "63a59935-f459-46a9-82a4-848d43902579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855969, "uuid": "b13aa34a-1182-43f2-b6e9-ab3f0d15b7e1", "value": "12288:yC66Bm2iNNRsdvtyAL7pYiRas42N4omRcXnUqMYjfCP66B:vVM1rRsdvzLjaSdh2PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855969, "uuid": "564ad838-809a-4906-9f72-11fb82e192f2", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855969, "uuid": "429a28f5-0bdd-44fc-b20d-f14372b1e46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855969, "uuid": "927bb790-b04f-4b1f-9b70-5ab61610317d", "value": "1bdc70b47e7a3cfd638eca937ad2117c53ac6cf9fe042cd46fcbc9971d06504f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43af7b29-a7a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675857235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857235, "uuid": "5639dd10-3807-4c37-be36-4df94d3e3f4c", "comment": "Malware payload (AgentTesla)", "value": "3af76621e40c36665c48e334efd15f75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857235, "uuid": "7f85883b-6a62-47ce-94e8-316bca3801fc", "comment": "Malware payload (AgentTesla)", "value": "1bf8b62a62829783a157a1d6c92f5535edf7acd57adea8611d5a6077d0bcfe5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857235, "uuid": "ca6b5d21-1f9b-4942-bdd7-1cf3eac2bc29", "comment": "Malware payload (AgentTesla)", "value": "051c5ec9fa498757d585fca87e0d4e3b71871aa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857235, "uuid": "9490859c-f8fd-4f7c-9c68-643b660b15c0", "comment": "Malware payload (AgentTesla)", "value": "d740d68db988c375da90e9afbf8f32edd84e614746c840acb909590033b727c5ee1b9f2fa16842b276f74246f5c3895c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857235, "uuid": "63c88b4c-4ba0-471e-b316-9de46bbc84ed", "value": "T11DF433C579519C1B82E98D53904C223BEF54C0271AD58317FC37EA93A57E94AC4BB0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857235, "uuid": "aed0562e-7174-4e93-9a05-9a7be658e4f2", "value": "12288:4e+nEK/qT6F6u5iR9lOcC+UQdLCmM9C2JgHEERvHQnP+vWXmQPGpjdbAOBxQ:4elKXOflVC+U6gwjvwn2mMjdbtxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857235, "uuid": "b30fce67-219d-4aea-ae45-1d9299a3268f", "value": 764639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857235, "uuid": "d9607c08-105a-45ff-90b2-03918a1eea7d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857235, "uuid": "676c4350-6f48-40fc-b139-83804bf95697", "value": "Accessories Required.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014c7dc8-a7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886759, "uuid": "3a96bc31-ed05-4110-81c4-b99b7653000f", "comment": "Malware payload", "value": "55e57c52cd5e1dcfad4e9bcf0eb2f3a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886759, "uuid": "8ea6ac3e-c71e-4d67-abf3-e067b81ceb90", "comment": "Malware payload", "value": "1c3052c642d836f188f0ae036fdfd7a3440ac8ce994ef2f73fc2707dd0ff90c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886759, "uuid": "464c09f5-a59a-4d3c-8820-c07768001106", "comment": "Malware payload", "value": "04b867e16737dbc2343749c6302ad8eed88ef04b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886759, "uuid": "3cc6bfc9-32d4-4b75-bf49-f60368718200", "comment": "Malware payload", "value": "131ae92330ce03be43dc3bd06703c627ddc049b8897247c705a367f7192cc5fa1d5012582f7524875239cc6bf2ea757f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886759, "uuid": "43d25493-8f0a-4bb1-bfa8-dbac7a0baa38", "value": "T1F665AE3BC6A7FDEF372C244858081D530D583B1343A54A6CDA5A8A7D3DC9226DBAC5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886759, "uuid": "60998831-3aad-43e3-bda2-05bd53484213", "value": "24576:n509gdZRKmrclNVjLk809NLBZj7/5cWvzof/GwE4Bwu8+:0Mvdv6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886759, "uuid": "ffd3e6f4-9a05-48a0-aba8-5708371d4662", "value": 1506474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886759, "uuid": "fbe43b38-f68d-4211-8def-de622b2d1c27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886759, "uuid": "8bf59785-f576-4335-8bc1-0da9b20f57f7", "value": "Detalle_Retiro_875427.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebce6b0-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675881923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881923, "uuid": "7f2028fa-39c6-4344-8597-f9ca371ad303", "comment": "Malware payload (Amadey)", "value": "e83d3b32eb9862aad1f3cf1b2ffdccff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881923, "uuid": "473a6931-9c91-4e8d-b84c-32a4aa7611cb", "comment": "Malware payload (Amadey)", "value": "1cf2b51863a2a76c9bdbff9d368609bccbdf4de5b4f585b6666472ede68bc339", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881923, "uuid": "eea5d85f-cda0-4b9e-8e80-385711d1996c", "comment": "Malware payload (Amadey)", "value": "3b44a4eb83098e43495c9e392eee0f87848164a0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881923, "uuid": "037d94cf-f6da-46eb-88be-868f447702e7", "comment": "Malware payload (Amadey)", "value": "ef80581fdc00aae3b1d93d23ada3ea0f1386eb816ce69f85d4f8eef1cc3a092d7ff2be3cb5d9e0d1b4415b51816c2146", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881923, "uuid": "13dbebab-0e08-481e-a891-600ada39bfb4", "value": "T163C40207F6E8D031D8B55B705CF206D315367EA46A38879F238A9C5A49722B09B3277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881923, "uuid": "e94074a2-e16e-4d14-b8b6-011991cf3ca8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881923, "uuid": "04f85dbf-36d3-4aa5-b569-2f3ecae403e1", "value": "12288:9Mroy90HMM/JVwdK8E6J6sHmGm2b1itZp:9yCvBVF8E6R3gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881923, "uuid": "b2900656-7a64-44e3-96b2-33e7ac1d66d9", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881923, "uuid": "e418a38f-bbd3-4769-973d-ebdc5cdb365c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881923, "uuid": "c74aa8c6-3889-4680-8a33-4c2f3263e5ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c52f0f-a7f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675892303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892303, "uuid": "7ec6411c-9ad8-43be-b3c4-5e40c86ccd33", "comment": "Malware payload", "value": "14634830f5255cb09adf444c5482efc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892303, "uuid": "31a778ad-f6c5-4845-b603-8958066cb6e7", "comment": "Malware payload", "value": "1d27385d440f2299d66a03f89efab3adee19945d8c5a13274592a58138b979fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892303, "uuid": "021a2234-f3a8-42fc-ab50-cd67554e7466", "comment": "Malware payload", "value": "d1546bebfca6d9e783b5e02de7401913153be315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892303, "uuid": "69ac90ee-8af3-44b7-972a-94f1d6da0597", "comment": "Malware payload", "value": "d271889299968321e3c572c708f634aca07176f0f3a3d57995910037fca8aec9da639ceaf3a35e0fb743fda629df55f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892303, "uuid": "007f47e3-14c5-43b1-9ce2-5c32382d8be0", "value": "T18E641903D2E17C81F9658B76DE1FFBE87A9DF5608E4AB7A63218DB1B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892303, "uuid": "cb22ae67-9216-46d9-ac5c-41358d317028", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892303, "uuid": "a19c5696-681d-4b31-aca7-2512de2f634a", "value": "3072:RPggRdv55yn5RFImgdQAfgPhWZ3kB+qf7jjsWQDiuLpB0gvG:RvRlyd8GmgQJUtnALiqjvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892303, "uuid": "1e9fc2ff-2698-4176-9064-58ad987cae84", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892303, "uuid": "ce5fdc48-f376-49a0-aab2-6b11a7199c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892303, "uuid": "bf49a965-5952-4005-bb8c-a1632bfd651a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d9f3be-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675858958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858958, "uuid": "835725a6-7f4a-4cfa-a4de-ce7dff31ee4f", "comment": "Malware payload (Mirai)", "value": "1e1eb6e2864479fb6302302307f05c2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858958, "uuid": "2aa8a927-d175-481f-999c-52b98255dbdf", "comment": "Malware payload (Mirai)", "value": "1d85f4dd41e01d630d32361436abd3393cf3c76a4a77b28da747bda07a32e01c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858958, "uuid": "2531182e-7474-4ed5-84c7-eb265197e7b8", "comment": "Malware payload (Mirai)", "value": "a440664384ab78aa67bb2865fcf8ec50fee15c7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858958, "uuid": "dd730461-ba04-4fac-885f-53bd239d0c9c", "comment": "Malware payload (Mirai)", "value": "8bb7c5c1971c0434e8faf8a57113ccdd50d0c5bd1a0919445bb6b1a233ca9a4bc78c3d4205206bd463900ce312741f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858958, "uuid": "8863c6c8-f496-478b-a923-2b51aa3c6cf9", "value": "T161E2D0EFA9943D59CD9EA83D22DD15B86FE760842313CFC6172209C0592B8B9F49C87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858958, "uuid": "3ddb2111-94a2-49b5-ac4f-48a086827ed5", "value": "768:qfpWcehPrY9/mcP6E+DCzJEWBbMvjYa3TWp:qfkcN/vb+lUYLYa3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858958, "uuid": "974acdbf-a996-4ba3-97a5-954b34c5cc58", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858958, "uuid": "74344676-41cb-498e-a55e-0567b1b890a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858958, "uuid": "5429187b-6489-4db3-ba39-bd54a80078e0", "value": "1e1eb6e2864479fb6302302307f05c2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea54afb-a748-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675816344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816344, "uuid": "f3b4e4e9-cfa7-466c-bd71-7711224d1073", "comment": "Malware payload (Smoke Loader)", "value": "5964ca4d64b110fd219b409bb4ca49d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816344, "uuid": "e744ec71-9c31-4f99-862b-765ec3c3b0ab", "comment": "Malware payload (Smoke Loader)", "value": "1dc481cdd33ed4fcba7727d74f248bbd66eb61de35e976c4603a77ed0f78a863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816344, "uuid": "713f0d44-2171-4968-9d1b-bac75be81af8", "comment": "Malware payload (Smoke Loader)", "value": "3eb425803050ba66c6023498dfcf8761579d63e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816344, "uuid": "4b2e8c02-006d-48e7-9c98-c8ca0cd584db", "comment": "Malware payload (Smoke Loader)", "value": "e81d3612afe6610761cdc6a9be977d5284db758afaeabc0ecc541bcf54e3c3fb61e631567be7844b9fde5ec6544f5cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816344, "uuid": "64710b09-bf1c-456d-a4aa-9f8b7037c816", "value": "T16614CF323690C072C17B25705820DBA55BBFB93096B8C95B7B980BBE8F317D5563A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816344, "uuid": "79737e41-36a4-494e-bee9-6c602085c21e", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816344, "uuid": "b2de2559-fda0-45f7-84db-5ced115972dc", "value": "3072:PGcO17ggL7abLjkdWHba5OF7QWGso8ETnrPmls1J5gHnwW:PGcZmwL4dWTFBo80PmyiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816344, "uuid": "ca6f5ce3-3093-492c-8952-e56a9f4f485e", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816344, "uuid": "bb360faa-b2c3-4826-be37-0e4adcdcd7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816344, "uuid": "69394917-1092-4755-845a-89b42a86d449", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a88849c-a802-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675896304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896304, "uuid": "eb9fe618-aeb3-4d3a-b2c2-d107da5c1e83", "comment": "Malware payload", "value": "00b2e97984bb7106415139b2a458f0c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896304, "uuid": "75fed79b-5b94-4e13-bd2c-08694f8646d7", "comment": "Malware payload", "value": "1e493e06b46760dfd0ef24cbb6876d0483746fcabd785f4de7bf1133bd357227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896304, "uuid": "ae6338fa-fe1b-49e6-aed7-3c98c4b28aef", "comment": "Malware payload", "value": "c4a2cfd612aae5aec1d442036ea4671c4c36e643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896304, "uuid": "580c8e60-10ad-49ac-88f5-d2cf104a813c", "comment": "Malware payload", "value": "a2e5f027240e82e9a67771eb1a02ec49b7589df758df1dda190019542f52faf77c8a735293c57b2371fe043e2fcda5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896304, "uuid": "01e126d0-f48b-4fd3-af33-32a298d34da9", "value": "T151C40207E7EC5022D9F667B019F202D30A39BE92577843571B8EAD9A14726F0B23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896304, "uuid": "abd0539f-2ca3-4f2f-8165-b667a76c5434", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896304, "uuid": "bbca5b9c-2fe4-48a4-a881-4c61f0654638", "value": "12288:1Mrty90tIvxmPF6kWzZQyOC6cRxeMoNO1OJAllSHbAZLW:0ymIvxmwkWNyCDxezNGlsHSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675896304, "uuid": "36667182-e0be-495e-bc99-deb6d389078e", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675896304, "uuid": "db043ce2-bead-48a4-8247-1a761b4d56cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896304, "uuid": "0d96af26-030b-47a5-a363-3405fe48504d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037cca53-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881609, "uuid": "477a95d2-0870-40a6-822a-b0d5d4224e99", "comment": "Malware payload (GuLoader)", "value": "a911fcb381e94db6603ee3bbed255241", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881609, "uuid": "82d479e0-d2ce-45b7-bcaf-d424e90a6f5a", "comment": "Malware payload (GuLoader)", "value": "1ef04afb88292cc59711d31f29175aa4ee66f0fb5431c417ad4f02cf3588d935", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881609, "uuid": "97fc0889-b95f-46f6-9a1c-7a33aa2d4597", "comment": "Malware payload (GuLoader)", "value": "e388706d286fca439dae5d0e59c446260e29e47e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881609, "uuid": "49fa60b1-9dff-4468-9d9f-438e450dee58", "comment": "Malware payload (GuLoader)", "value": "7419a71c1da821bdaed69c456712089a64983dfb4804751dd31c817adb733d3121bf6b02f6c43365e609a9a15643d527", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881609, "uuid": "1f458efa-8a06-4077-8aaa-d2b86500ab86", "value": "T152C39D949F0A2501090B17ABED472DA8803D11B760271C3ABE98F3BD158375ED77EBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881609, "uuid": "326cc642-31fa-4479-aefb-8f0723ff9b95", "value": "3072:FXFq3Cj8LqP/D9+y7jP0WCuH4q07guhoK:lFw/mPL9+yXFHv07N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881609, "uuid": "0c42b164-7cd4-44ec-af17-bcb737020da6", "value": 127585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881609, "uuid": "9e581eb9-770a-4851-9c1e-7723b0ca131c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881609, "uuid": "3afb4d4c-1df2-44a8-a190-3d26298a13eb", "value": "PagoFactu.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f94e9ce-a7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675859859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859859, "uuid": "7a19c5c9-470c-439f-8575-e7ab11a16e7b", "comment": "Malware payload (Mekotio)", "value": "800c872eb4605be4441d5dc34f3b3ab6", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859859, "uuid": "a0233932-feaa-4e3f-8e30-2ce336ca0e2f", "comment": "Malware payload (Mekotio)", "value": "1f963d1274d8b0155bb9f44dda8e29d2adf79902a6e4832084b569f39c69e97c", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859859, "uuid": "81508d67-0506-4396-9238-e0a55663799e", "comment": "Malware payload (Mekotio)", "value": "918d14904af1ebf5f559a05cb6ac2ea2a30cf1e5", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859859, "uuid": "e630b08d-1456-4a34-9bed-28e56f59e41f", "comment": "Malware payload (Mekotio)", "value": "c3c9df9fd8c3a3ae57b46fcdf3a49605af82707b35d049aaac71f21854af61e384d6487d4f14a966da04ca24b2f79bfe", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859859, "uuid": "f43b64fc-55c9-4e4b-abb3-605f6b4a0a68", "value": "T163E633C3A536D0854B7D27B8525147E60C308AC4D09524CEADE232B382EB7EE66D7E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859859, "uuid": "8db08b31-4c5f-4ebe-bda2-30988ffaf262", "value": "196608:EB5ntjg1j0DxXcPPzBNMkyIx9Lq2FmyErlO9O6TuTGWAVKA89n47/tqdD9otMmHr:EDtjY01sP73rTmyYIOP7OaWGmHMwfK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859859, "uuid": "088d7c2c-ac55-4769-b2fc-bdc0e49bf133", "value": 14644052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859859, "uuid": "a6ed9fc5-a6fb-4c1c-bec2-b7c60622c49d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859859, "uuid": "6a3d53f6-bbcb-442c-944b-4ee8b5da5009", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14771ba-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675856104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856104, "uuid": "b15ef976-9e3b-48fc-bb86-a5941109ef69", "comment": "Malware payload (Amadey)", "value": "22a5fdec4a92af140ae554bbfe937c9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856104, "uuid": "e470ceec-023f-4f02-8322-4985ab614a7e", "comment": "Malware payload (Amadey)", "value": "1fef06cc106cfd3fe290aaafacabf35128f33a0c74cafac06a8ca410d3ccd182", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856104, "uuid": "81bbc5e4-5c36-4908-b735-8305c24f06cf", "comment": "Malware payload (Amadey)", "value": "5370297f3137352a76842e597c53b71a1e08589d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856104, "uuid": "21da7e45-c0bf-4fb0-b815-202a91168bf2", "comment": "Malware payload (Amadey)", "value": "257e7ddbab1e67c48664b7a6d6ddb5a0c740be92e5e26f4e263d8283fe1e9ac163a7e4510aa80bdaf970bda75a84c25f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856104, "uuid": "80b2b13f-eca7-4e2a-9c9a-a2d64bc7174f", "value": "T1EBC4020BF6FC8072E5B1577119F703D30E3BBDA05A38839B234B695A0872565A6353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856104, "uuid": "aa3d5284-2eef-4218-8378-7049abfeeafd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856104, "uuid": "2e8b5ca6-aef8-436f-8c97-256de0e9e914", "value": "12288:sMrYy90PEG/VSzuLBnh659y0SydRh02CYeM5aP+VXYlr:MyZGJLBnhAy0SYf02/esaPCYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856104, "uuid": "f16b3878-1113-483b-9767-d1ec2f101e77", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856104, "uuid": "8747833c-a8b3-45e1-98a5-9fc579ec9f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856104, "uuid": "18a8481c-4d5b-4576-8f85-2f193dc2b890", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfdf162-a7c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675872070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872070, "uuid": "e21db66c-8bc7-430f-9a45-db32c4e1db0a", "comment": "Malware payload (Amadey)", "value": "ba715d40a9cd5d545d2ffe17807d8fa6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872070, "uuid": "118132e9-41b9-4efa-a1c8-cff346453072", "comment": "Malware payload (Amadey)", "value": "20421ef56eceb8a746cf4fa86f2efe10688f59edc22cfcedefbb7441578a839c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872070, "uuid": "dd5e2578-7d73-4ac1-93ed-343f9066f888", "comment": "Malware payload (Amadey)", "value": "4e5a39bb665dd176cb604e7598b211b65a974d8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872070, "uuid": "4752aadf-f0e1-41e8-bafa-bda3a579daec", "comment": "Malware payload (Amadey)", "value": "f1d4ac2f804301249d547552fcfc88dc68ca4569d27d97179ab21374aa2d36c223832c8f2084f5bc1365c81a4c08fcd7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872070, "uuid": "680d087b-b56a-442d-96c4-dccbc450e66f", "value": "T1DAC40247F2DC9032D8B557B028F603C3063A7D619E38926F269B6D6E1C722B4663537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872070, "uuid": "77cd6985-fa5c-401f-9d91-b60a33ff4ee8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872070, "uuid": "b5f56d11-ed44-4307-bbae-5cbec36cc4dc", "value": "12288:HMruy90rRl4z8O/G2S4BM/+dwyzKNN+9PttZIej7WC2eYP:9yQR6z8OeX4BM/aijeVt2eXWZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872070, "uuid": "25a3ab3b-6fd6-40b0-8d70-d912d0a0e917", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872070, "uuid": "ba3ac4e7-7634-49fb-b271-e775baa2ba8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872070, "uuid": "d4a49d47-c646-479f-9718-6db241648bd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8138d204-a7d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675877525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877525, "uuid": "07c13941-b062-4b29-812a-eb0c75b21bfb", "comment": "Malware payload (RedLineStealer)", "value": "23957566ac74d2a7232e9179f0fe268f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877525, "uuid": "c0b34f00-fcac-49a8-91c1-0666b8548099", "comment": "Malware payload (RedLineStealer)", "value": "204bc8ad0aa52de00a499b7c950119455f333952b0ade8b5de0267917b044897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877525, "uuid": "c2870a20-f057-4364-a21d-106ceb464e18", "comment": "Malware payload (RedLineStealer)", "value": "752717de9a8bb477662272a7a931bc5f7a045501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877525, "uuid": "52a800a8-6a95-43d4-b573-8f282a090cc5", "comment": "Malware payload (RedLineStealer)", "value": "0689dc5b5136b4df4cc37006f5e6c6f7fe634785bcc00499996e1ca291b8ad4f4405ff13fda9e304f345b8aeeff67401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877525, "uuid": "32a55836-9d88-419b-94f6-fd9710f5ed9f", "value": "T145945A03D2E17C85F9258F769E1FFBF8765DF5608E4AA7693228EA1B14F01B2C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877525, "uuid": "13969599-e9b0-4bad-8f47-b53bd39e3642", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877525, "uuid": "80c5a7fc-f53f-4e77-96e0-97d54c9be8ba", "value": "6144:nHbrQd/8Yrv4mVks8EFBD0aSo1Z0M72GTZTExqwgwtLiqldQv:n7sd/bf/8EPYLE/7dTKxqnwN/dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675877525, "uuid": "4b4186bd-4ad3-4db0-b176-e36d51250ef0", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675877525, "uuid": "8a7fc587-2105-41de-9392-3d7a82262815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877525, "uuid": "454fa0d7-45ed-4ea2-a2bb-63570311341b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a57004-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885323, "uuid": "9229f6b8-995c-448c-ade4-fcb54c616a4f", "comment": "Malware payload (Mirai)", "value": "444ea147f483f9549d7c434392492d39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885323, "uuid": "a540cec8-1b47-47ac-9b63-5776356e31af", "comment": "Malware payload (Mirai)", "value": "213dbbb3e2a13172c1e8ed0e4a32f14a2ce8c68bc492828f17acb6510537094b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885323, "uuid": "2a528311-7afc-484b-8aa7-c8e2e545a92b", "comment": "Malware payload (Mirai)", "value": "c45a683b11ffee5699b8c974dc0ac5a44c5e0c57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885323, "uuid": "7b439c2f-a500-4ddf-92ae-1c7984a1e142", "comment": "Malware payload (Mirai)", "value": "7b1020f674a0b5d4069e835222d46872d47bf8b4550db11cad78aa26bd18ca7f675ad4e2e33d91286f80c143942d7d08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885323, "uuid": "2eb7ca81-9109-43ec-a3b0-72d2dbf49735", "value": "T12003F751B8829A77C2E1137ABA6E4A8D336163E9D2CF7217DD214B20BAD511F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885323, "uuid": "8c878496-754f-45d5-858f-512224fc5054", "value": "768:MglA4CbIsG5f0OhnlUl0O9FRA1wArb9/3W5uv+bdJdUZXoT8+/NbwW:MyabXG5fDlUlXjwVe4v+2Z/+qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885323, "uuid": "db90e37d-4d4d-4d2e-bc0f-897b2ee4eba6", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885323, "uuid": "70b5fa82-7863-4421-b61f-dcf75a6a4e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885323, "uuid": "4b8062ee-99b6-4bae-b759-96a05b82a6f9", "value": "444ea147f483f9549d7c434392492d39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a9705e-a749-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675817111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817111, "uuid": "2a882e57-1c7f-4c49-8d23-b70e9dcf37e3", "comment": "Malware payload", "value": "5eebe6a177ed6458cb4b1c3f066d3682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817111, "uuid": "baa3fa14-cfd2-4fc6-a67c-028efe82a24e", "comment": "Malware payload", "value": "216aff751115d8cb76f6e1304f27ae08d2669e63307e6063a41a44b011e1092c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817111, "uuid": "e1964aff-f6dd-44f5-92d9-661c82282ade", "comment": "Malware payload", "value": "3ff5bfe30e9f8090db3f262b48cf741471d9e800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817111, "uuid": "960a4f90-b7c3-461a-95ab-e90affea1077", "comment": "Malware payload", "value": "a75abd0d9ce7745c620c4bb0dd4618c06959c0ffba8931e9d8878360b9226360aecc78522b2b11a7852a33688225215d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817111, "uuid": "86316520-e4bc-4819-918b-c847cb22126a", "value": "T16F45CFD337F19863F68B10B5042C77892FE17203BE95A257A77B7AD09B118FBB298141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817111, "uuid": "1402aae4-78fd-4db1-9b0e-d7bb465960eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817111, "uuid": "3d213964-24be-478f-a19f-2f7a893b840a", "value": "24576:k1dH+AOUP2KceZiwTYnzcJ8RuIEMVc+doOEpTc2JrgSTS6F0xMpqG4yPa:kPHrOUufeZiwMEqu9MVhOOQTcWWiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817111, "uuid": "059ca4bc-0b72-416f-a430-bf3ab13b1397", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817111, "uuid": "11cf7f44-d5ca-4645-bf24-85f3ebd54997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817111, "uuid": "32741520-93b0-482b-b880-fa95217b666c", "value": "bl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5063ad61-a783-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675841794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841794, "uuid": "e153916b-533e-44fb-baab-cbe07bfe1e40", "comment": "Malware payload (RecordBreaker)", "value": "8270ad48ec5a23c45790ba5a8c955d91", "object_relation": "md5", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841794, "uuid": "71d83042-e5ca-49d4-bafd-a26c508018f8", "comment": "Malware payload (RecordBreaker)", "value": "21bda41cfa9d6fa14e74918b7044a57d393b90cb2ece561615681a0726108322", "object_relation": "sha256", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841794, "uuid": "5b3ec035-3dd1-49ba-afc4-ac643db00ad0", "comment": "Malware payload (RecordBreaker)", "value": "621b795fe4d0a9a085de460d2018e5754a058cfc", "object_relation": "sha1", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841794, "uuid": "b2b97666-a239-4047-83cf-7caad846fea5", "comment": "Malware payload (RecordBreaker)", "value": "4afaf5e5ffd92f0c6f6e51eda2ec1268f51e6d24d034d19937e294c284bd9a7d3eb3684c3250b09a78e4db8c8216bf36", "object_relation": "sha3-384", "Tag": [ { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841794, "uuid": "856a770e-3135-4797-8838-d8db221290b5", "value": "T152272378A4B8B86AF4A4537BDA4A3CB6EB3CD440D7643D4F9F20415ABD8310E0F55C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841794, "uuid": "8e1ff5d9-3d14-44e4-b232-d216141c919b", "value": "393216:GEDW0JB1rpdmE0nh/ydmEhnhn8dmEgnhCXuhc8pyUpUvRhjDF:vWaLV0nh/2hnhnsgnhCXuhc8pd07DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675841794, "uuid": "26b572ba-5859-49d1-ba56-5b29e37cbd45", "value": 21774480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675841794, "uuid": "19ec48a4-3d46-4520-bdf4-af49a37ed632", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841794, "uuid": "e36dac9e-66f2-47a7-a2c5-462cd5f1eedc", "value": "Expert_Pc-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3992d5bb-a77e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675839609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839609, "uuid": "721e99f8-e4b3-4603-9b89-e80784fa0803", "comment": "Malware payload (Smoke Loader)", "value": "4514f6a9d55ee79c7e56c8305fbea220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839609, "uuid": "4992d4de-422c-4d00-9942-bab71f6c4e48", "comment": "Malware payload (Smoke Loader)", "value": "21dc9e4ad607821c38f5423685b199291f56cffaf8737835308900d95c27c250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839609, "uuid": "75c738ea-d525-4d94-b6c4-0cfa89df34d2", "comment": "Malware payload (Smoke Loader)", "value": "2c6110cac62c74d9f436f7a1eafc11b1d9be1591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839609, "uuid": "a500bb16-5c95-48e9-914a-571a89b4d60d", "comment": "Malware payload (Smoke Loader)", "value": "6366b1d0b06bf69e0204a5f372a9f1addf6329c73f4c2f4eac58f3d359d1a4bba9873dc29e53e7489ed9513add7c3384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839609, "uuid": "f9234f36-b430-414a-988c-4e39aeac21f9", "value": "T11F643A53A2E17C48E9258B33EE1EC6E8F61DF5D1EE0B37693219AA1F18F0072C567611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839609, "uuid": "de402af1-cffc-4f22-b0a1-d7436cde460c", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839609, "uuid": "25d8d502-f990-43e5-b033-5477d22463dc", "value": "3072:5wRqy30GyXR5AF25ARQvJpVqWH2Ii0T7+CeEyUJWByUAl1dmvBW:5MZ+oRmqWWIBuCeEDWUjduI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675839609, "uuid": "2e76a8d1-9a21-4197-a471-2e89f39b8172", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675839609, "uuid": "f0c3ed91-1536-41eb-a9fb-84ccba61ae01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839609, "uuid": "aff99b19-817d-4cfd-a25c-9fccec3996ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d783119-a747-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675815993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815993, "uuid": "5a4a7cdb-6b0f-478d-a9fe-5ac5a5a689ee", "comment": "Malware payload (AsyncRAT)", "value": "291c5da0eca2141479f54d468d766a68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815993, "uuid": "04dfc5a0-2a2f-41f8-ba0d-55f9abf3b7bd", "comment": "Malware payload (AsyncRAT)", "value": "21e1e60efdbf24f5f7e114e509096ae87ad1ef70c23f3361c61c70be746d788b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815993, "uuid": "c59e4c26-8c78-4a90-9af5-d09703efd9b6", "comment": "Malware payload (AsyncRAT)", "value": "9b62777d43b45a080812d347c031cfbe1810a5a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815993, "uuid": "ab383cc6-8e44-49a7-b057-d56c90f4327d", "comment": "Malware payload (AsyncRAT)", "value": "8e4b2c511c320a54889e6fce38a7d424d5e38d1563ce25bf954ad4daa7c1ee864719e6b816ebe04c25863ce348907b33", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815993, "uuid": "3c8da62c-f70f-4b1e-913a-4d2dd8a1982f", "value": "T192F38BBCA5DB49D8F54F944536FCFFB5023233F399C91E61132896448BE5EA92E4808E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815993, "uuid": "9f17a810-c085-4da8-aad4-751dae68212a", "value": "3072:gN2A/QIyO2MjD9L8mtvDNOQkowmGcA63Apm:gN2A/QIypMjD9L1xUowmGcA63Apm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815993, "uuid": "63d24a77-676e-4df3-8a5b-6c2090077045", "value": 167959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815993, "uuid": "7ef55fc9-6d4f-47c9-a48d-40e6e35595bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815993, "uuid": "d9d02fb0-104b-408b-ac80-5ab0c0f45107", "value": "image.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492908b5-a7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868841, "uuid": "bc479a50-ad7a-4ebb-8b6f-763fff991efb", "comment": "Malware payload (AgentTesla)", "value": "8e28ada5d436a59064af402d4af09692", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868841, "uuid": "7c1b9d44-6da8-45f7-b1e7-0be8db117b37", "comment": "Malware payload (AgentTesla)", "value": "21fde225cd1c673d0db0405e8a677a720c865eb02b9919ea2c561ddf821f9035", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868841, "uuid": "64ded8da-a58e-4cfb-a2fe-5ad46148e45e", "comment": "Malware payload (AgentTesla)", "value": "7d77bc91b6666d880cd35a60b0591d19fee67408", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868841, "uuid": "1658f050-cd29-4e6b-9b81-b35fbfb24bb7", "comment": "Malware payload (AgentTesla)", "value": "7682ee40830964013cab0d943715e0954d4de24cd7914d6880ef38e9817d0d5677fec965af6651b80d17f99710b5c07f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868841, "uuid": "7e7dfa4d-32a1-4cfc-bc84-9365977716e5", "value": "T191642355F59732143B37831B5EA0B147DD0CF9A92DD78764CA874F22CA58E800BAA6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868841, "uuid": "5c06414d-f53a-49d2-beaa-2bbe3bfe39a6", "value": "6144:HStXawbDVMqRTphZIxsZmoioDaqngNYurgQKzcDeAuUwEjm4uN:ytK4dRNIToza4EgQKwlwpxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868841, "uuid": "bcce59fc-a5d5-43dc-8295-25be4d216ad1", "value": 308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868841, "uuid": "8ee9fe54-1448-4b1f-8129-740909e24519", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868841, "uuid": "f25c9cd5-24a9-47f6-8b06-51bf8cda8e95", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358ea290-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675855923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855923, "uuid": "eafd32d6-3d95-4f08-b3a1-bb379be09c03", "comment": "Malware payload (RedLineStealer)", "value": "ce12548354929b311067f9dc5e131635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855923, "uuid": "e70ffb09-1b87-4edb-bc8f-59a9278ebb84", "comment": "Malware payload (RedLineStealer)", "value": "227a201553af55550825eacd7191f52e18ad781d8ff4e2e42fe8e69c1bc43819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855923, "uuid": "459de75b-90bd-4320-9b2f-33837f209690", "comment": "Malware payload (RedLineStealer)", "value": "77d66cd3f9d248f6d8da0911aa2f1f4daed0d1a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855923, "uuid": "11f501f6-8f48-48fd-9e3f-777797e8f1d7", "comment": "Malware payload (RedLineStealer)", "value": "99e96e96ea7fb16e5a4a2386a570411f55aa068c1f3cbb51794d640a7a5d9321ad92ca00d6b097ed60e058aab3e2f4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855923, "uuid": "12bedd4a-332b-4475-8dac-3001c05dd1df", "value": "T13C947D9392E17C48D9258B73EE1EC6E8F60DF650EE4F77693218AA5F18B0072C563613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855923, "uuid": "b5e429da-920b-4429-986c-fda4d7578eec", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855923, "uuid": "f7995c7e-2929-4a62-a75d-1e43e5a81c63", "value": "6144:MVBQ6c1UJrjk0G5DiFqJ230rwPB0y5GleWUj7GXgIn:MfQyJnAiFhkuOy5aexSgIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855923, "uuid": "e38df86c-4d92-4bde-99b8-4a57bdec9506", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855923, "uuid": "11bb59a8-1236-4125-8358-55da4e2dd2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855923, "uuid": "fa94abbd-7952-4490-b47b-eb680765b792", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62949123-a7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883486, "uuid": "f42804c4-96e6-4d8e-94bc-f7521439d660", "comment": "Malware payload", "value": "ecc142e36d1ffd1b9d1b2500eb40f54c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883486, "uuid": "a5c41f9c-c615-4b7b-8e2b-c36732202d67", "comment": "Malware payload", "value": "23124b3112aae802cae56fd9aec2cf96ecccd4354c472d364fddd8de948b702c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883486, "uuid": "b9962158-c6c0-4015-bc5a-c5faae812625", "comment": "Malware payload", "value": "b7411023217ace421caf9e091482d43ac972ce73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883486, "uuid": "1e480b66-f63c-4d72-80a4-31ecbaf7fb1b", "comment": "Malware payload", "value": "f34c589419c5c63758bcc9b127acec585cf5dcbb773f248a3d40f49a7b909e56b8dd3461c24902b4c64c6bd66a40b0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883486, "uuid": "8285fec0-a2d6-4ef4-8308-8b0b45a38dbf", "value": "T173C40207BBF89072E4792B7018F703D30936BD611B38C3AA279B5D581973AB4A535367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883486, "uuid": "62cd8a3e-6ea7-4667-a439-870db59dcbd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883486, "uuid": "7cd79654-1d54-4944-a391-a74ce4a053aa", "value": "12288:zMr0y90sPZVEMtLnWtpAfY3t6DwdYFjUXoqFb0+NITlO:TydV/wtpAA3t6taoqR0x5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883486, "uuid": "23e2db17-0e25-4999-b609-92d456bd2c7e", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883486, "uuid": "88be0ae5-7840-4989-8f4e-126e31e96c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883486, "uuid": "73094b71-738a-4c80-9c49-1966f5f84b91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc777a32-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675882375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882375, "uuid": "65c69985-f582-48ab-838a-46fcc3c9edfc", "comment": "Malware payload (NanoCore)", "value": "4de28c77fb39f6111eb2fc68e9fe78ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882375, "uuid": "dbae3a63-6b65-43b7-a6eb-cf7a460ab8fa", "comment": "Malware payload (NanoCore)", "value": "234c938fee28d016a6ddb6879bc62853dc69ec31f1226f6d135f453ee90f020f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882375, "uuid": "87e64aa8-303e-408f-8737-7a6e67dd9064", "comment": "Malware payload (NanoCore)", "value": "42a0fe69401538d562c702637a4a7d99ff81df5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882375, "uuid": "048b381f-6f3c-4da2-91e2-31073247247d", "comment": "Malware payload (NanoCore)", "value": "bf26df9665115e8c9047ddf69e698b001537bab50f5bae920549b2a54fe06dab6ed536b3588b1918741d45c2dccbb29e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882375, "uuid": "04b29a48-1c39-4b36-94d0-a350e35a3816", "value": "T106842268EBF394AAD97316318E7A19674B958D26E03747925BA0DB1D3713031CE0E337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882375, "uuid": "05b4f5a9-6c25-4030-b49e-f7450e53ffae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882375, "uuid": "5319d444-6d8c-464a-8aae-a285d1fba5e2", "value": "6144:xYa6aoVc4uC7M5gCXkLAvffzQRZKkw3IuK4A+f07HvOB3O3XQLcH6+CWXHffdM0N:xYcoVJuXXGKkiBKpecvNQLo/3fL9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882375, "uuid": "e5cc50e3-4b4d-4e02-8051-c844a4607bb8", "value": 379605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882375, "uuid": "e72233c0-116f-4411-b229-35796286977c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882375, "uuid": "af412be6-043b-4478-b048-7a22162979e8", "value": "4de28c77fb39f6111eb2fc68e9fe78ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7453547f-a7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675872349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872349, "uuid": "2d33504e-ed67-4cd4-bda1-8c70d6e9143b", "comment": "Malware payload (AgentTesla)", "value": "b983d7ae5788fb40c2fda069ef162fc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872349, "uuid": "56616806-720f-4362-b934-5b4855cff565", "comment": "Malware payload (AgentTesla)", "value": "23b23bbc8497e567eba43518485bb19fe70d295e54e5af14f90d233b33d862f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872349, "uuid": "bab2598a-f0ef-44fa-99f0-fa2997bd347b", "comment": "Malware payload (AgentTesla)", "value": "d8bad219e4c0520afd19de5e0ec1842c5f56f9e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872349, "uuid": "968f3ecb-3406-45dc-98ab-320f915d9238", "comment": "Malware payload (AgentTesla)", "value": "5cfba8882b6808ebea745f99eb7abc7a03b3e50e3502dcea12b9a63f9f325b0f3a9dbf2d0e65392170b4e8ceaeaaa4c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872349, "uuid": "09d2178c-0814-4953-a02d-62ee3f173ae3", "value": "T128C46F2D39B613E2C138F97A46EB8620B9BD62933303D958D9DE1BF04F865816D8F51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872349, "uuid": "39295934-9314-4737-b316-24076af12262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872349, "uuid": "d7e9b296-bd20-43d1-9a82-016baf80d02a", "value": "12288:S7rhVe5d6U6sRg9db30NOQA+/7lP2alQDL50VOcORIGhCTAaLmAiN3DyuUjW4nRg:8LsRg9db30NOQA+/7lPI0VxUIGhCdfeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872349, "uuid": "07e9eb28-1b34-45e0-abab-5b9c61063c93", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872349, "uuid": "c209e4c6-4d91-409f-a41e-93cfad412455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872349, "uuid": "413e08f7-aa59-49ea-86f8-98d9e3ee7a2b", "value": "Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c7910e-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675883148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883148, "uuid": "0d3f6779-1455-4979-806b-72d88da400cc", "comment": "Malware payload (SystemBC)", "value": "40753d4f4ba5863be3aaaa38cd50995a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883148, "uuid": "86d7d993-923e-4c77-9904-bf95efbafa35", "comment": "Malware payload (SystemBC)", "value": "23f66ece38393f81fc1f892c9243cebb6e5412b95629cc07fa83065f5b5a3e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883148, "uuid": "ad08a57f-844c-449e-a5aa-1f0fe49b47ee", "comment": "Malware payload (SystemBC)", "value": "cb58f6a57ecd27e7380e0f38dedb621d7d161e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883148, "uuid": "94e7084f-d8ff-42e7-8439-aa28a8038509", "comment": "Malware payload (SystemBC)", "value": "e496b765c9f35b8b7973f31a4ca0d6f30981110fc263ba7237557a41d5fa21b87453bb065b276909a63e000969d5cdc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883148, "uuid": "c6d6f30b-171b-4bae-903e-9f157280b665", "value": "T1A3B39E10FAF0D833C56648309875C2E1563BBC166E344A8737993B5F7E322E296BB356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883148, "uuid": "6ff3a989-972f-4161-b097-1664954aa78a", "value": "4903e7286931f23a5a1a98693f43817a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883148, "uuid": "abf89c66-ecc3-43bd-93bc-fc0d1c225e6d", "value": "1536:hGFLBB4S2zN22dyPPVHbPa3bjCY0X+9hGUhW5jSVM3JdT4AFuxbUS:hGFLBb2o+3CXXE1W520JdMAFuxbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883148, "uuid": "efa01a51-ec89-44ec-80fc-99b3b8b60311", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883148, "uuid": "54846985-88af-48c8-b070-6d99dedf831d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883148, "uuid": "cd9847df-5d81-4c35-9f57-43b890e51d83", "value": "40753d4f4ba5863be3aaaa38cd50995a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05486780-a74f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675819335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819335, "uuid": "f241cea6-8908-4ed7-a5cb-fe93eb545253", "comment": "Malware payload (Amadey)", "value": "775a230dca08f0271569e190928e45c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819335, "uuid": "799c1af2-0f52-41b8-a274-97a679c75fa9", "comment": "Malware payload (Amadey)", "value": "23fb9b51725e058bc2a6a73765c6757aa52827b81a162713fba630025c93bea5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819335, "uuid": "0aad29b8-142f-476f-84f0-a6ba493bf521", "comment": "Malware payload (Amadey)", "value": "63fe32b2716eae02052aa02ab6c27726cc3d5578", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819335, "uuid": "e15fb32a-3040-4780-a629-d7290d17f63a", "comment": "Malware payload (Amadey)", "value": "6be427944ed3621e15ad9a0875d1abc8154fa477b5fc05157fc491767ecbf2b293d9d82140d07b6d211422df8047f420", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819335, "uuid": "360a436f-e624-4a1f-bb2d-a2921940bb8b", "value": "T187B41203E7E84422E8B847B41DF646D31536BD905E3487AB330FAD9E0932264F6767A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819335, "uuid": "1d0dd868-2058-4442-b100-60bed45439b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819335, "uuid": "c9e20bcc-e23b-44f2-9c3a-c47756fc72a7", "value": "12288:dMryy90JU0rw3Zw6AyvSWqQlFdVGRvLWDqVs/aRMf:Hyu0wsflFrcWdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819335, "uuid": "5eba3254-2497-433f-afd5-be6275a22d13", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819335, "uuid": "ef9f2687-0652-4d18-8de5-46dd310f79ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819335, "uuid": "1b9b7d64-4875-4c17-8e6e-7ecb8ca34ecb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe8752a-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675881334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881334, "uuid": "b5bfcb27-0820-4350-a607-124614248774", "comment": "Malware payload (Amadey)", "value": "600d89ab04d924d0c95c0987905c3ebf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881334, "uuid": "216fcdf2-aa15-426d-aa73-00e6abc32a91", "comment": "Malware payload (Amadey)", "value": "24550e2decc0f3fbea221c153c5ca2810c8ab2875d78845a4e1ac18f6d27bb64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881334, "uuid": "7fcc9348-d4f4-452f-b581-bc8ad7ad6eb3", "comment": "Malware payload (Amadey)", "value": "c85f8f22598b76991c7437c54456faa471434c5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881334, "uuid": "730a893a-a08d-4395-a0ba-bcd1ed60a712", "comment": "Malware payload (Amadey)", "value": "3adbea062330956a661f1d73a4602046b660215483e2c52874b7bf0f2572deb592585fc4d6f03a3a670f304efdb936da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881334, "uuid": "810d743c-e93c-4ee0-96b3-dfdb3b90bfec", "value": "T1D7B4020BE7FC4031E4B517701DFA02C30A36BDB15A39836B275E6C5E18B76A4623676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881334, "uuid": "4bf4c65d-1974-4ad6-ac45-66231ed87e1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881334, "uuid": "ba084e49-65e5-4d77-856f-c8246cc55059", "value": "12288:wMrny90v9lTrUh6bSCXSic8eqLB8cZ0Rp4E:Hy+xrWaFnHZ0f4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881334, "uuid": "d8f625d0-c3c5-4cfe-8009-47154f1b378a", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881334, "uuid": "1e377447-c18f-4a8e-a1bd-23f8bd7dd203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881334, "uuid": "58415f67-d460-41e2-87ff-fd7bbf985a39", "value": "600d89ab04d924d0c95c0987905c3ebf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96be948-a780-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675840655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840655, "uuid": "983358f5-9825-4723-a0bd-d61fdca57145", "comment": "Malware payload (RecordBreaker)", "value": "d95df22eea9b8127b42dbe95e995332e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840655, "uuid": "b5fc9e33-2191-4680-a7a3-0df3854f85bd", "comment": "Malware payload (RecordBreaker)", "value": "249fdabee73ed5eedf5480c80f57b7a4d8fb0ed7ae1fd835e1f1bf583232d749", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840655, "uuid": "42d17f00-c50e-44fe-bb7d-29a6e118606c", "comment": "Malware payload (RecordBreaker)", "value": "a1fab18749de179691f3cb5c349ff2d7d0f6a8b4", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840655, "uuid": "58f8c722-7748-4210-b87c-e0d283f2cb6a", "comment": "Malware payload (RecordBreaker)", "value": "ac4ed3708ddccf73051fdd984c37680aeff1d4c328c72b337825daca30d7f4ff52e84ffe985d278cdf1992284f50b3ea", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840655, "uuid": "182ad31d-44b4-4ef0-9b88-dce936504ac9", "value": "T17F17334ACC1445AA1D7F5EB66511FF0B963BC0DD78688AA6D0CE93A0CA347390893FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840655, "uuid": "290be277-fc32-4ef5-a5ff-62b7cc17a28b", "value": "393216:cDc66ZxR5YGs2boCrRl1MxOWuEUL8ZJ0Q4A1OUausUeYNnDtRp6TCD:cY66ZxUGkCt8ZJ0QJ1lfnPDtGCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675840655, "uuid": "dbe17149-ebef-4a95-8550-3d363e463838", "value": 19253726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675840655, "uuid": "c8e97eae-18d0-4271-b9a7-e42c6069cd12", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840655, "uuid": "94e30802-51a4-436c-b374-6ca72abb9d49", "value": "Expert_Pc-2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e2bef8-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675853690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853690, "uuid": "46a09c8b-c141-447c-ada0-c8288893c3d0", "comment": "Malware payload (GuLoader)", "value": "1b9ad4e61264dfee5be3b3e9b0ebef69", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853690, "uuid": "c612c431-50af-470b-84d3-784163a64686", "comment": "Malware payload (GuLoader)", "value": "24cef4e5f41ce9c3295caae4b367525d51e6eb1826c45c892e6e800cb38cf454", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853690, "uuid": "2b3d7615-c7fc-4620-8393-20afc376d0f4", "comment": "Malware payload (GuLoader)", "value": "4550e87a3543457403d8c58b2dc0ba2e678e7522", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853690, "uuid": "5eafcd5f-1056-4f26-9602-dd1bbb9a80d5", "comment": "Malware payload (GuLoader)", "value": "032a71faf2e7e7f35b4f1a4aeb9529f2df30b90f011cc5ec770f7a00d85db6adac04644cccb03e21de9392311f335a49", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853690, "uuid": "832fa05b-919a-4669-90a8-a5bbc3eebd98", "value": "T1F5B423E41E68FBCBD23D1934312289ABE90BDDDB86A655B732D3CE9530049703B4A573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853690, "uuid": "cc5e5246-4f9d-412d-9244-799c932b2937", "value": "12288:WVp5BvCwuRaZ0wr2BuLCy7ODyXa9XsxLLE11g:Wn5ruRaZ0wrrCyQyXjLE11g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853690, "uuid": "3f5a85f7-69a2-4244-b2c4-990bec93c1e4", "value": 500914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853690, "uuid": "530dd5b3-6fd6-4a75-9fed-a0f9eba4d56a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853690, "uuid": "34f2c9bc-1927-415e-be30-c66e7a9bc050", "value": "Fact 23_000021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c541b0c-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881355, "uuid": "4a8538f7-92bc-4fcf-8ed1-be0a926f4e91", "comment": "Malware payload", "value": "ba64d93549b14d1d81e4d8ba1068c796", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881355, "uuid": "7a3de737-12af-4796-a82d-417ce08671b5", "comment": "Malware payload", "value": "2505b1471e26a303d59e5fc5f0118729a9eead489ffc6574ea2a7746e5db722d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881355, "uuid": "267249d7-7c5a-422f-9a1c-8df549c7e21c", "comment": "Malware payload", "value": "1a0b2ec2b000bf4acb0556f776b98d2ea45ba35d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881355, "uuid": "01199ca2-192d-4318-9a2a-a17fb418f87c", "comment": "Malware payload", "value": "de12f6187543c2c9711ede09841130fc644832d97cee13fd3bbfe3ddbcc27187b115f2d8893140734d18cff5f02e85f2", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881355, "uuid": "06f6d036-4e48-4ddc-a5dc-62c71f215e7a", "value": "T18933C66AB79AC846E6552B360CE6C6E97336FC416F5B83073244B73E1FB5690CA03607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881355, "uuid": "169a5c81-8541-45a8-bad6-bd8eb0930c71", "value": "1536:sblYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0/0p4JM46GciHfg:sblYkEIuPm3fNRZmbaoFhZhR0cixIHmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881355, "uuid": "074e6917-17eb-441f-9366-fe1f53b06daf", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881355, "uuid": "a847729d-b05d-47b9-8e09-a48cb050c190", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881355, "uuid": "9f800894-e323-4617-ad50-fb9721621b1b", "value": "RIMESSA_CASSEGNI08002023-2298.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7df6b3f-a79d-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackBasta)", "timestamp": 1675853135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853135, "uuid": "aa568428-07ed-49f0-baa1-5c9a376e8031", "comment": "Malware payload (BlackBasta)", "value": "1e9d4af109f42baa420598b1cb38d307", "object_relation": "md5", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853135, "uuid": "f805f717-86df-4136-bca5-f453ff5abadd", "comment": "Malware payload (BlackBasta)", "value": "2558d0817586306d0ddf7beadd371785cd0a0b7ed860ac62760dbbc92866008a", "object_relation": "sha256", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853135, "uuid": "028b302c-3b94-45e0-8a76-07fce488ddfb", "comment": "Malware payload (BlackBasta)", "value": "71db2886b1dde3e92bbab3af7be627f253532736", "object_relation": "sha1", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853135, "uuid": "6470182a-da39-4067-8a0d-87369bd24c3f", "comment": "Malware payload (BlackBasta)", "value": "eeb12b46ab95305dffb0dbf77da1efded50260b28c0d37c092ac0af7632e4213a8832e60fafc344f838eb2f1b4921274", "object_relation": "sha3-384", "Tag": [ { "name": "BlackBasta", "colour": "#ABD0CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853135, "uuid": "3a00cd68-5dc1-4893-8993-ad987bca0110", "value": "T14D25AD19BA02F024E5A110BE7D19D1FB51287D30176A44D7BBC27B473DA02F6ADBAE13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853135, "uuid": "7286e9ce-db63-4fc8-b2fe-6648cfa9492c", "value": "1e6f07b9f9776897a3906ee0a0569fcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853135, "uuid": "a0cc7ca0-f849-4ee2-b4d4-9b7805bc34ea", "value": "12288:yGdqKcxsQ/s3akSWFwLqNDgCvomCnY1vQL1V9k8t3/CDO2zq7byWGPoQyy6rAr8P:9qKcxsQ/s3fVLAY1UV9JYA6PzeA6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853135, "uuid": "4fba825b-5bda-46be-adcb-4de11582aec2", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853135, "uuid": "ad888eed-0251-4622-8c6f-e4fbc4262dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853135, "uuid": "d43155d6-0ee2-4ab3-b051-20e50c5e25c5", "value": "2558d0817586306d0ddf7beadd371785cd0a0b7ed860ac62760dbbc92866008a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b463b1-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881639, "uuid": "0de7ebc2-aedb-446f-a762-2ed0d311cd29", "comment": "Malware payload (GuLoader)", "value": "41dc8a33e0ad3c7e1dc6a7e82ceef9f3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881639, "uuid": "493db2cd-095f-4990-8464-eb836cce928e", "comment": "Malware payload (GuLoader)", "value": "25c62da172ade20b30e71185ff9ae1cb19713dbc8a86c306167e7e046912c3b6", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881639, "uuid": "988bc9f1-1ee0-483b-9c59-069e680a6e95", "comment": "Malware payload (GuLoader)", "value": "ef04a98fbb86bd0184849d8af88eb34ebdef877b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881639, "uuid": "3ef7b84a-2419-432e-af22-7f3f3c43abdf", "comment": "Malware payload (GuLoader)", "value": "5323106a8da54b99eb371d7fd4b4acefa934dd3f06536dcc750abe3bd6af358a6ca9afaddba6a9e4a11eda6931575304", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881639, "uuid": "9bf89303-4409-40b4-ae18-ab0b583046f8", "value": "T13AD31671D9E9061948CE167AACD21B85C46A4FD520BE2427ECB507BDDF27348827F22F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881639, "uuid": "1268edd1-b213-4782-83db-713070463cf5", "value": "3072:v/rJmOzfVKUTvt3cXHRTj8ae2ZgnUVUo4WJrs0uoOpXdOQYtjQQwMBF+8n8RGYiw:v/gcfs+qxToS6U6+0pdaQQwm5Yf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881639, "uuid": "226e65e4-ec28-451d-9d33-41d5e3cf3db8", "value": 134298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881639, "uuid": "178a40ff-ba6f-463a-9ce7-ccdeeb67ac59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881639, "uuid": "3b0c0e25-8264-4cb2-96fe-7a93a4ba5ffd", "value": "20230208100.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1da44dc-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675882438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882438, "uuid": "e8702523-7d4e-4cd3-8946-5ebd70d0848b", "comment": "Malware payload (Formbook)", "value": "18631c9f2c7e9bd49b4b7f7b938ae94f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882438, "uuid": "0d4fd70c-9b74-4b10-b2be-22a4295d8300", "comment": "Malware payload (Formbook)", "value": "2666d6497d3cc713c61afcf15370f3f4efd89e1dd719afcb99c1184236b35112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882438, "uuid": "e73da523-4ac6-4c49-ad65-8b80d4bd8b6a", "comment": "Malware payload (Formbook)", "value": "3bc345be423005b3e146d2cce8343c59ed9dd8e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882438, "uuid": "4fa8649d-1767-42e9-978e-49256fec9388", "comment": "Malware payload (Formbook)", "value": "836fb2089494a7ae20baa3b19c576b272b260530379028b33088d42074c2fb61508c3fc718338532128ba280f6bc5329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882438, "uuid": "915eb136-db90-4d16-81ce-8e9e83e6f6b0", "value": "T1F0541261FBB0D126E9B23F351E3B1B6256FBD927C468461F13A01B087816543DB2DB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882438, "uuid": "f14a93c3-6061-46a8-9b5d-f3037d632d3d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882438, "uuid": "b5a967c5-def1-47ea-87f1-20399fb554fc", "value": "6144:BYa6Dh4qR0DyWIHQ7lRTKLAfPQ3dsJ8pJ0p4mZLiTuZD:BYhiqKGQBKLAfo3dG8nI4mZLKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882438, "uuid": "244384e8-c0ce-49e2-a68c-637d27fb7d38", "value": 296005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882438, "uuid": "ea92dfa4-97d6-4cab-b08e-0a74a6989b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882438, "uuid": "2a8485bd-9df3-4aaf-bc0e-dcea7da32b34", "value": "18631c9f2c7e9bd49b4b7f7b938ae94f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893fcc03-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881404, "uuid": "8e0344c0-c977-4ed0-8d72-bc4d3a0ac2f2", "comment": "Malware payload", "value": "c918ec8388dbd07a40a1447cada9457a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881404, "uuid": "aada1a48-7175-43a8-90fa-e5072e3dcaf1", "comment": "Malware payload", "value": "26ce04c7a20090a1bf55a6a1efac50d5464f0bd4a511cde8caf03a5d7c44d2fb", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881404, "uuid": "6bd81a56-e52c-4ff4-aa02-3e2f5ac986b2", "comment": "Malware payload", "value": "f82c57681d6f43dd514395694fd51e4feb0f7fce", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881404, "uuid": "fdedb132-276b-4ed6-a29e-f5bf5261929c", "comment": "Malware payload", "value": "3e031e0a1d2a844917bfd2d44bdc984eed1b4682d467a9261d5819f6e21da0405b15d0c59a2f6677e6c9379017449cda", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881404, "uuid": "5083c5de-4d28-4c85-b19f-b514d2db8adf", "value": "T139A5022BE152DE1BCE268430D81F34C2C2659C9DAC2D5B8DB1C7735A95374F201ABEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881404, "uuid": "b794269d-ae44-4483-87d3-f4d0f7536023", "value": "49152:n9rSQlM9nqx5uJ1mNGN2DEkjI7/VHZPM:nhSiMInwmNG8DE6IV5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881404, "uuid": "f664fc2e-df25-4108-92b2-0f317fcd961f", "value": 2132992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881404, "uuid": "b6367478-7d10-4723-8e66-299d14a5d1a5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881404, "uuid": "48879401-2aea-45c4-8e9d-e340844275d3", "value": "SHIPPING-DOCUMENTS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e268ff-a7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675866394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866394, "uuid": "658affd0-3ffb-48e1-93dd-0c5556c176c6", "comment": "Malware payload (AgentTesla)", "value": "0616f10e96697ce17283d427a2945363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866394, "uuid": "142cd587-8e66-48d3-852b-98ad53a8b1cc", "comment": "Malware payload (AgentTesla)", "value": "277695c9c74d59d603816ca495662666d702dce65c7949468eed50ad5e8171a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866394, "uuid": "0aa57784-046a-4afc-b5c9-26a0aa8ac86c", "comment": "Malware payload (AgentTesla)", "value": "ed197871a35504e4afa09275b72fc7531d98eb88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866394, "uuid": "f828ea57-8985-478c-a33c-d99bc09e8177", "comment": "Malware payload (AgentTesla)", "value": "ac01c73b9e48478c87f95a613e2531d13e79e16a013b012461260ff1294e8318de7d9431698e204d52fcb6dcb5cc63e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866394, "uuid": "74dcd41e-44cd-4c6a-9147-39d387344ac4", "value": "T16C52196062EC5523F8BE5BB98CFA5100477CB6D3BC22DB6F21C551CEA9827814991B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866394, "uuid": "020f5958-c4f3-42fb-85c1-68e6a338660f", "value": "192:OzYVebFsga0ixbIbZ8It/FboMi9N+ebEXny+n+azeqKAohkxu6wzyuaZN4M7:kYVYVMIL/FMMIbE3BlzZKF6wzbaZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866394, "uuid": "6f9b30d1-b245-4b27-a359-129a6a3c43fb", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866394, "uuid": "cd29553c-8e04-4207-acff-03a116d3d19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866394, "uuid": "3b9c9b39-0fc8-4100-b1fd-37fd6d100069", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf2ca78-a747-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675816207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816207, "uuid": "29a1e033-ee5d-4fcc-8011-2b2811daf751", "comment": "Malware payload (DCRat)", "value": "2fd11955a0ade10eba5952203058511f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816207, "uuid": "4edc123e-cc06-466a-9d7f-a8e0ac4a71b2", "comment": "Malware payload (DCRat)", "value": "28155cf7392b3b62565d966c8fac62f93f5ee2d170434c4ff8e08a0a092e8688", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816207, "uuid": "192b175d-aee6-414a-a434-e806c0730957", "comment": "Malware payload (DCRat)", "value": "b85b34f605a9a1d4b3fedc93e9129a007062bd74", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816207, "uuid": "723eb764-600b-4391-8c73-b5064a9bceea", "comment": "Malware payload (DCRat)", "value": "9e1fe87bd7d17204f2eaaad12b4af2b152f03747fb640caceebb66b7522997d2dd151c03b7955faca5c10edf078b871d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816207, "uuid": "14b73dbd-0e36-4509-99cb-f1260434afbf", "value": "T1F9455A027E84CE11F0191233C6EF454887B499516AB6E32B7DBA376E65133A73C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816207, "uuid": "f3b53f47-f813-438b-ac76-7f1f5c719062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816207, "uuid": "e3b9d50e-587e-445a-a8cc-a1e180101355", "value": "24576:Lm2evs/11n0kZj5WX7fj8XlllzqVaoF89qLSSUUaxBGHd+ZcSi:LvKejZNrn8EoWwLSSSECP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816207, "uuid": "56426457-a5ab-43f4-a1c2-22402ee74d43", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816207, "uuid": "5306dfe6-f9a8-468e-93ba-b1ea8e40cda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816207, "uuid": "a7ac1fb7-3392-4526-b961-e24972ebd142", "value": "2fd11955a0ade10eba5952203058511f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6716a5ae-a75d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675825512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825512, "uuid": "517dd7d6-c0ae-4908-bc23-aed9d55767b8", "comment": "Malware payload (Amadey)", "value": "4c426d349555c6db820e230def4ec998", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825512, "uuid": "1b101be5-52cc-45bf-bdb3-782f9ee1924b", "comment": "Malware payload (Amadey)", "value": "28265ee7cc0659f89173ae05776697446f72b5475ad028079cc8926f51cf792d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825512, "uuid": "4ec4c414-799c-47a3-bc5f-1d084bd07ccd", "comment": "Malware payload (Amadey)", "value": "4b9c6b235e3134a39bd3efb31b4bed5f5769c368", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825512, "uuid": "c86d12ba-e0b0-46af-9930-c0b327d5c2d6", "comment": "Malware payload (Amadey)", "value": "9563328bfb1d683666c1d52fb362c14ba705452cfeafbf2b2db4bf5601213bea52d210628322bd8dec9619362a251bc8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825512, "uuid": "33b83e1f-f230-4657-b0b4-b31aceacb909", "value": "T1D5B4024BB7DC4422E8B52B7009F702C30A37BD91573493AB625EBD5E08722A8B53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825512, "uuid": "ee7b3185-d17f-4ac8-87a2-85721857e047", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825512, "uuid": "f4d7f03b-0a7e-43ff-8016-ebae3db56d05", "value": "12288:ZMrVy90v3JW+6Rzg7kwKeFs3c3p2cPVccZaajjdrClL5NOFvGV:cyk3IE7krZ3QecUajSdNOFuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675825512, "uuid": "ab017033-46b4-4adc-8934-e93c7362a415", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675825512, "uuid": "69c0271e-654d-4553-918c-266fedfe1ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825512, "uuid": "58f7bca4-18f0-4a21-aaf4-e37d0d2ef985", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f8aa56-a760-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675826803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826803, "uuid": "0351f420-d148-4384-b98b-56e9aff81fe0", "comment": "Malware payload (Amadey)", "value": "60f6b0a4c6cafaffe3f48cf58d8f6cef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826803, "uuid": "ea930ac8-035c-468c-a676-7b05cdd7547c", "comment": "Malware payload (Amadey)", "value": "284e7b6e4c38f26712b7bee40468c0694b2467566fee93e59e07e40053c87c60", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826803, "uuid": "80df3ae5-1dfb-470c-b758-cbe39ef1d61e", "comment": "Malware payload (Amadey)", "value": "56addd0e908bf0a453d5287ce6e3e3c4c29b8fd6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826803, "uuid": "4676c90f-6d84-4c60-bd50-96cf3bec73e6", "comment": "Malware payload (Amadey)", "value": "64567629bc726c43e8591ca82bab64e0a6d3eae1555d074a1e1af12e04da17b1d61480aa1660b86f3a297775b9b0b007", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826803, "uuid": "e46a8216-4cc6-4342-aafd-c598961e1dbe", "value": "T152B40213EBFC8032E5B45B7009F603D316377DA15A3883AA278E691B19726B4B53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826803, "uuid": "914447c2-0351-4dd4-b891-921e724ef622", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826803, "uuid": "74afc6d7-372c-4c8e-9745-f667202cdedb", "value": "12288:gMrey90Es+JVgd7dkH59Dar364mEfnBhPfSog+j3:Oy7sSVK7ueG4mEhPfy+j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675826803, "uuid": "d38ba2a4-2941-4038-9df8-43279a6afc87", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675826803, "uuid": "13fb0eea-ae82-409c-9937-1566093cdf2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826803, "uuid": "dff73a3b-16ce-46f9-a4e6-091e9a6b4501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9f702c-a78e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675846539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846539, "uuid": "1e82bcd3-5de2-4ac1-af98-62c3730f320e", "comment": "Malware payload (AgentTesla)", "value": "c4450dc642eeb865077f02e64730ceeb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846539, "uuid": "d32f6833-c1d1-4e6a-9c84-c14039fd340e", "comment": "Malware payload (AgentTesla)", "value": "28de18cf90f5beb1eacb1250791b85f689ac9df67c85578f6d62adcb46fe35a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846539, "uuid": "5b7bb034-3fbd-45a8-a5d8-6e3b23a5ee8b", "comment": "Malware payload (AgentTesla)", "value": "f610fa6db641359fcc48c71606c85432ddd76361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846539, "uuid": "aa954c72-5532-43ea-b975-af29adb1227c", "comment": "Malware payload (AgentTesla)", "value": "d5de204c3afb0677b9dbb029ca5b9674c3a84111f16d660fb44ab86630b08c8fba6373de353d208beefb4360b6fc66e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846539, "uuid": "b1d2a519-6e3b-492a-b6e1-9d292cc2fa3f", "value": "T1A8C4C33E69BB57E2C578F97586E18420B5AD83823303D999DDDA2BC0CF0128A7DCE55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846539, "uuid": "85eb40b3-2915-412b-a45c-8e926a3d262d", "value": "12288:wcBXiEZz7yDne7f4WYMTyPdLX2tuCAe/ZXazVt1Ek6ugpRZN7gNFSxCDH:jRJe7MTyPdLX2tuCAe/ZXazSkKacxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846539, "uuid": "f8ff056c-6639-440c-8df9-b11e460cb7a8", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846539, "uuid": "e51e00da-2883-4b68-8716-4cb7e0c9b25b", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846539, "uuid": "68e6f22e-d72a-4e94-a70b-10c3bae4c76c", "value": "30% proforma invoice.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b267f0-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675882362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882362, "uuid": "8314ffe9-accc-4c0c-a3e6-e56659bb0955", "comment": "Malware payload (PureCrypter)", "value": "5c919f2537a5cfeff4e29059ef1e5b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882362, "uuid": "d314a142-81e1-42c8-b32c-0aace309e47b", "comment": "Malware payload (PureCrypter)", "value": "29638eb7cf86d0e9ae512dc93890a90a4b881035829d515a80f7fe83ce94b99a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882362, "uuid": "6e823534-d2a0-4f4e-8c21-1468017ebc28", "comment": "Malware payload (PureCrypter)", "value": "2d40e4349924ccf6f4442aaaa3f3c555708f2bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882362, "uuid": "4b8af09d-c5e1-438f-a952-86220b3b7458", "comment": "Malware payload (PureCrypter)", "value": "ada63863b3a0fa8b8966f42f0a2e838d47346e277feda5cf04dbad1552646ac7a52c4a2211803d97c8e3ecc509759a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882362, "uuid": "f94e9116-7c6b-46cd-b555-796422062e11", "value": "T10116F125229C91C9D17AD03DC9864AABE7B57C428364D7CB05A0BDA93F336F56E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882362, "uuid": "3f261f00-266a-471b-9110-3f585a1598b3", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882362, "uuid": "78678ade-c130-4d04-a07a-657ca5e041d4", "value": "49152:Vv08Ro21Buk5/xgX1s2eXF4lzFUJD+StpClQXAFo4658AgNtU:teO4I/xy3Ks6JD+oule6tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882362, "uuid": "d4752933-9bea-4168-bdc7-a8a5e6ef995d", "value": 4204737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882362, "uuid": "2d2d5e14-3049-45ca-8a08-0471fb380eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882362, "uuid": "9d5a5e25-dca2-480c-b58f-02decb1baddb", "value": "5c919f2537a5cfeff4e29059ef1e5b51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4589cc-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675881031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881031, "uuid": "79791792-e10d-4911-ac9c-9fd94669968c", "comment": "Malware payload (RedLineStealer)", "value": "de96c207715030cab16a00325061d516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881031, "uuid": "a3ab97c9-ef7b-4962-80f8-59d99631c232", "comment": "Malware payload (RedLineStealer)", "value": "296c932dc8da8809cb15e68cebfeeaae621f4ae0f11b9aece20b4b4ac22e1d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881031, "uuid": "5a90b512-3d7d-4058-8eff-ba4be579e204", "comment": "Malware payload (RedLineStealer)", "value": "693a6d62872df5149dbb7f787093daa616760d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881031, "uuid": "2ca1844d-c476-46be-9162-30a8c7a3db60", "comment": "Malware payload (RedLineStealer)", "value": "22f06f0d7cd98aba2f7e1c44759475833e36d1c0f7d3fa02392ed088f359e1366206798900940797e183155246a623c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881031, "uuid": "49ab7efb-cb06-42b2-8718-d50eea7bfc7a", "value": "T1CBC4120BABEC9032E8B4677049F607C30A35BD516B7947D7338B6D5A18B21A4B5313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881031, "uuid": "4b15ac07-c1b4-4718-a3bb-37fcbe670b37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881031, "uuid": "6f7cc54d-8b5f-4563-87ea-863afbc1b613", "value": "12288:hMrOy909TqvFHNRmU5i9uVTHl4t8WN5jayeKIGoOx8y+qbO:TyhvFtRmU5i9u52iWZeKItOx8yhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881031, "uuid": "1aa4cfc8-3118-4987-a6a4-6a9cc335a9f4", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881031, "uuid": "066a9a3c-e4cf-4ec6-a50f-b9ab92340214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881031, "uuid": "83c7b631-430f-4bda-9833-8afde597eef3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d058b1-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675881480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881480, "uuid": "8735ed54-6bf9-4490-add8-ea4e59ede5f5", "comment": "Malware payload (Formbook)", "value": "f77a61ddbb4fb65c094df3d6dca123c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881480, "uuid": "9a44c4ea-2dfe-4939-9056-37bb7005c676", "comment": "Malware payload (Formbook)", "value": "2a61e0add99b698af28cc73128adfcea58d0ff6bc7e83f60f20dbe17d4062eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881480, "uuid": "05ed90ba-b063-443a-9575-1475f8f4b1ba", "comment": "Malware payload (Formbook)", "value": "21ffa60707fb515e8372b97c7bf4d3c023cb7c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881480, "uuid": "b9b0868d-44c1-4d6d-ae86-efcd107943fe", "comment": "Malware payload (Formbook)", "value": "94f86336cf743939a27b14f7d3806da6f112e1144a7cf5127f7a72b82a6b2de0560bd604c09ac2650adad3001daf7957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881480, "uuid": "4e5e43cc-b922-47e7-873f-df9bae784bfc", "value": "T167A4AED6D5409890EC666B7A6133CD3A96677E7EAC78A20D1ADCB9333FB36C30425503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881480, "uuid": "e486b19e-7173-4a06-804a-b1af2858a64c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881480, "uuid": "8a93a2ce-adb8-4577-bb6c-6a0ca5a4d59d", "value": "12288:OY+//tP+nHCkSRNdT3yVb64KdBNJneCsrygjs:OYEUnHCko3SVKblMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881480, "uuid": "fa0a5247-a095-42d8-a8b6-8c7447c7fe9b", "value": 457937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881480, "uuid": "7243aa30-49b9-44ac-b380-3c7a76902d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881480, "uuid": "37e26b59-80e3-4b05-8498-71b37ca274f1", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa33be31-a78d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675846240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846240, "uuid": "207697d5-4079-4edf-9634-b0551cb15b79", "comment": "Malware payload (Amadey)", "value": "7a457cb4647ea555932bf1413cafe849", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846240, "uuid": "41bb3da8-afdc-4489-bbd3-c56ca4f157a4", "comment": "Malware payload (Amadey)", "value": "2a63c290a4d1a4a2545b2152d7444bdaf8e0a916c73ae1500505d1de885d3999", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846240, "uuid": "10342b79-c342-47a2-a635-a7df376d1263", "comment": "Malware payload (Amadey)", "value": "0891c4657575ae94af9d93e5d4dfa0bc4c92fe98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846240, "uuid": "9142c52d-f7c1-4e3d-9c7d-a93c6e120779", "comment": "Malware payload (Amadey)", "value": "a7388f04a8e5f7603efd216ce772ff43f86b9ffeb818f2d921957ee7aee0ff5f7ea8477d53507b3f6b197131a6a10401", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846240, "uuid": "73b29362-1e7f-4052-a98b-e64c3ee2f6c5", "value": "T153C4121BB7FC9026E4B697704DF702C31E367E515A7886A7234E5C1A18729B4B2327B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846240, "uuid": "9af9b1b9-4aca-4ef0-b43b-9452afb34337", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846240, "uuid": "626732c0-d77c-4c23-a5c1-387f88e7c470", "value": "12288:HMrIy90X50B6ClVDv1U2QTXIj62d456V+PrNE7L6ypOIT07V:PykiV5U2aOLML2LrX0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846240, "uuid": "65b3a9a1-e235-4580-af8c-f366cdd65817", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846240, "uuid": "085df4a4-82d5-4c6f-b623-f751d6919629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846240, "uuid": "c00f2ca4-7b9c-4036-a0f4-bef234c25bbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5459add-a751-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675820516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820516, "uuid": "f2732752-5d75-4736-bcc1-8b386d9005b8", "comment": "Malware payload (Vjw0rm)", "value": "419305573d7875bb81fac618ae2ffd54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820516, "uuid": "24577b8e-b6fc-4000-88ed-af2020dc75ba", "comment": "Malware payload (Vjw0rm)", "value": "2aa3d59f66c023633926e86785ce7492e065df9542a95aef04d5ba55bab5ad6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820516, "uuid": "1c1ea72a-3ef7-4a62-8287-e4e78797f93d", "comment": "Malware payload (Vjw0rm)", "value": "2346a2c660b9d8183ee61f80516d8a0a52b84be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820516, "uuid": "46e9fd41-e58d-40ee-9329-9273d3ea7e1c", "comment": "Malware payload (Vjw0rm)", "value": "f84300b85044a5d9e7efdc5c221d9b18daee562b48bba71f051b291f155e365c58574bc90cbaea8771301581c35dfe4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820516, "uuid": "fd3af2b8-bd1a-49bd-9ff1-03b0541bea66", "value": "T1EC344A7A661D9AC2FDDBD6709DC823C5D8026BFA9368D9EB37D91683414DBD0B0B3012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820516, "uuid": "c8b53905-0ce7-4255-acff-30f69e88991c", "value": "3072:92LKf/fJp5ZRxBhlFV1tNd9YaqPvf/HnX3Lrb7DjTzCiSya6qKe+uOvdNtzTDj7a:9Zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675820516, "uuid": "5a1c6aac-7487-47d7-ab7c-ae1356234f26", "value": 230890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675820516, "uuid": "786f0c1f-c5c1-4a6b-9e03-35e13c068c7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820516, "uuid": "899633d3-fd02-41f0-9b92-5bbb50c1b7bb", "value": "209384WURN02_INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07064d1b-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675867871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867871, "uuid": "c3477aeb-9274-434a-8fe3-a34e02316796", "comment": "Malware payload (AgentTesla)", "value": "076b423f8592dc850b8dc972f0b06b67", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867871, "uuid": "eb793fcd-2e54-4722-bedd-1cd1437e9da8", "comment": "Malware payload (AgentTesla)", "value": "2b517795146a3c057fda526ff26d09b60813496b7a7f9715ef492c6e48079cbc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867871, "uuid": "2b043a2a-0c92-449a-9673-eeff150c228e", "comment": "Malware payload (AgentTesla)", "value": "d8f1e42ef47fa5bbf93e1faa82a01588a474cdc3", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867871, "uuid": "64d2d3e0-241a-4659-b585-6e6339919582", "comment": "Malware payload (AgentTesla)", "value": "87f5a3a3a0f6f8b37ff6db319ef2c6952527b3ef3659c5f19555406d4879dfbaff154de97ebebb6269c3c6192c046c10", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867871, "uuid": "4bccda76-c0f7-45e0-b0ad-f8bb1a4f220e", "value": "T1C22512612118CB20C92843BDCDB19AF157B66DB9ED24EED77DC2BECA7A3175210846C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867871, "uuid": "d70d2009-abc8-4e09-8370-0d132128b36a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867871, "uuid": "c97df77b-9465-4415-a0e8-260bfb8434dc", "value": "24576:f1bgzPGhgzfYZ0Vxeku6iEl17CMZ/Y1NwMYej:fZyPyywZ0TektHl1mMhoNwMYej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867871, "uuid": "d7111973-5671-4d46-b958-73b6675f5b4a", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867871, "uuid": "a1562991-375f-4fd9-a2b2-e81be6b85777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867871, "uuid": "cffaca37-f1cc-4372-906a-e0b12d6cc5b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7c6e6d-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675846865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846865, "uuid": "6af1621f-c20b-450f-860b-5f3bb865eec3", "comment": "Malware payload (AgentTesla)", "value": "9b76d76a13b2d20a0ba82fb3571ab477", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846865, "uuid": "d9371a66-0ea0-4c93-92a3-addadba22219", "comment": "Malware payload (AgentTesla)", "value": "2bbff6d93b38a6ffc24b7f707edf5686e0cf5e92889c0a467ff37ab74198bd1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846865, "uuid": "821fc262-9e2f-4f16-8c31-8debb136bdd1", "comment": "Malware payload (AgentTesla)", "value": "e377c4a293b23dbf90d92a18ec80fc8aadf6153c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846865, "uuid": "34b0fcfd-a9da-4dc8-b32e-d885f959a023", "comment": "Malware payload (AgentTesla)", "value": "bb94c01fdfe85ee9f225ce80fbe68022f12b1e1553228ba73542b6b0401d7f87da3ae9826d9064b174544d1225238f0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846865, "uuid": "f8ec2f80-a0ee-4e0d-bdeb-ac383296411e", "value": "T104E4E63D597A57E2C574F93986E28420F6AD87823307C958EDD63BC0CF1268A6DCE61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846865, "uuid": "e3ef0d5b-30db-4a50-b31a-b9593dd7e314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846865, "uuid": "49d79bb8-58ca-4ded-a8fa-da2090d43f97", "value": "12288:42KFLDne7f4WYMTyPdLX2tuCAe/ZXZ4niDJ9qDLOKHpLPPubh8pWCgJ33333333J:45P7MTyPdLX2tuCAe/ZX6nnnnubh8p5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846865, "uuid": "0dbf2b79-be13-4b9c-97d5-6671baa7c6f2", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846865, "uuid": "f97d59d2-129d-4dd6-bd72-54ae52fe517a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846865, "uuid": "94722815-df2a-4012-9ee9-6b46b1702a09", "value": "Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5354e1c8-a758-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675823331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823331, "uuid": "af5f6544-1ddb-4933-9623-7a8af441f93c", "comment": "Malware payload (Smoke Loader)", "value": "84527253122e790977e28ac85f88fe32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823331, "uuid": "1cf091f7-641e-465c-bea2-930ac0f0a11a", "comment": "Malware payload (Smoke Loader)", "value": "2bd588c1067b5ac4159f2b9da315f661b9bcad295b33f6f9aceacb19e394ad33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823331, "uuid": "80ee0b34-d9cf-4a54-83d3-70e9d4b852c0", "comment": "Malware payload (Smoke Loader)", "value": "f98f3f4f67c95be4367a803ff617202587755c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823331, "uuid": "33a431d9-c52e-4692-986b-328cdc20b744", "comment": "Malware payload (Smoke Loader)", "value": "2ee17aa36d1fff0adbc055e54d53e10daca3ee15a4f64dd1123799bc8553b509a0ce2e95b3de9e8625113c2e5666a683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823331, "uuid": "54f47283-ec36-4651-b84d-8f528edf286f", "value": "T12C14E03136A0D033C5BB64705864CBA56BBEB8304675CA977B6807AE5F313D15B3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823331, "uuid": "f0f77248-b885-4c89-a191-ee98cf0c3943", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823331, "uuid": "14016c8d-37e6-4277-acf1-d0f8d58b45b0", "value": "3072:kfYO89pK83uvLqi9WRa5ozCT+Qexe5mAlYOtChXazL:kfYXxgLb9CzCTaxe5baOeaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823331, "uuid": "0ae3ad3d-d771-4ca1-ba79-07c0e684a879", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823331, "uuid": "7c70acff-d0a6-4c29-a604-285468ac2d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823331, "uuid": "fbea26a7-909a-45c4-ba30-4d910c045f62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c3f183-a7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868915, "uuid": "a3f90bf7-0487-41ae-951d-a506c305e3a5", "comment": "Malware payload (AgentTesla)", "value": "4dcee385a673a3605d6cd23d7b55a7b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868915, "uuid": "bd0d47e7-16b8-40bb-98c2-745ae02d5ac6", "comment": "Malware payload (AgentTesla)", "value": "2cc531761d03240741bc92e58cf9691b2038c04f3d5cbb2319bae5b7363187fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868915, "uuid": "bc47c1fd-40b0-4be5-b06e-dd2e68ad1820", "comment": "Malware payload (AgentTesla)", "value": "df389b531733d847df7388c807d50845084e0265", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868915, "uuid": "48f0dfe7-0f4b-4a32-ad4f-0fd536ca8426", "comment": "Malware payload (AgentTesla)", "value": "e549b9b2b653f93519b6a84fc047301ed9928cf53675631edfff286c640d3ce5c18486285cf07511b30643e0ac8a48e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868915, "uuid": "e80debd7-4647-4cbe-b0aa-32127c8c08b6", "value": "T1EF842390FF0C992AB2048C086EF27D5BE9616C9BEA5B770522F07421EB1E57D2409FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868915, "uuid": "11552512-9891-4fc3-a85f-632cd323c63c", "value": "6144:Sc+of66yv/LfycibUSL6hZKfG/bn/fz1UCf4NcR2ZxZiZ/QRuLMDG3:S6dkLZo6hZY6/uy4CsSZIRu4G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868915, "uuid": "cc11b980-ba13-4372-ac8e-1298a8cb4bdb", "value": 399349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868915, "uuid": "1e5dfeea-3138-420a-8ba2-5707d03ae2a0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868915, "uuid": "8357af77-2618-4f07-bf50-8f9099e220a9", "value": "IV22200102 08-02-2023.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4ad547-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675859018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859018, "uuid": "585cf5c7-7b53-455f-a65b-1178fc06ca55", "comment": "Malware payload (Mirai)", "value": "7a658a5b5b0ee918dbaa3baaadcbde03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859018, "uuid": "89df6ff9-0ffb-43d5-8640-a04b0ecb3296", "comment": "Malware payload (Mirai)", "value": "2cdba3b4c25a0dc6854c2509647ef8c6c73720357dd0650fd2e0bc546b600a59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859018, "uuid": "95db4b62-a94a-4337-9fa8-74e2a33fbea7", "comment": "Malware payload (Mirai)", "value": "b841ae3f5b58c18cae2077d9bfbdb6cd9184ab00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859018, "uuid": "95b2afb9-443c-4645-8e61-f8e6c1c914a5", "comment": "Malware payload (Mirai)", "value": "1dba02dd6deb34df934ab4477c839d1f55a6233509c598c3fe15b72f03a2b9c1289a6e6e861b76184e155926a09f5f34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859018, "uuid": "36d363ae-f7ff-4629-9884-a6b23941169f", "value": "T15C535CD9B4119E7CF9CBEABE88224E0DF860221154930B27BAB7FD937D32195DC52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859018, "uuid": "a4ac44a2-4870-412a-b226-5fa749c476bb", "value": "1536:j0klfwJ/mebn9ykMB97l88g1pkPwzF5LR5kSF/zlgs178g:j291a8xpZJlR5VgyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859018, "uuid": "2b8a1925-f72d-4210-adaf-646f040ce863", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859018, "uuid": "cc4541d9-6f9a-410a-8e94-1e08023be2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859018, "uuid": "808dadf5-4a1d-410a-9c25-e8bb4e1955f5", "value": "7a658a5b5b0ee918dbaa3baaadcbde03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69515f4-a7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855763, "uuid": "7f5b9fca-286a-4613-b1bb-2377f4a2efa5", "comment": "Malware payload (AgentTesla)", "value": "96228f66b89ab4cdd0f5fa3150ad0a63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855763, "uuid": "c83e8ef7-6bd8-4fd5-9252-42e68587d70a", "comment": "Malware payload (AgentTesla)", "value": "2da7438f282d04c21b019bb91a8d4e4730ae0b9f693fc0d9a57762d2fe765b0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855763, "uuid": "fea35d57-efac-4c62-ab3d-7a460f2c5daf", "comment": "Malware payload (AgentTesla)", "value": "2fe8a4c39896096639f170ba2f5afa6d7f3fa3fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855763, "uuid": "fd6f5c1f-11c8-4474-aa71-b42aeac1505f", "comment": "Malware payload (AgentTesla)", "value": "83a70fb4b57a363ad4e1461c9977317118a06641724b19d1cc54a8415ea3e2c4e1f0bfc246f1fe579a45774c61bf40e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855763, "uuid": "3e1392af-8782-453a-b3c0-eaa0d6853524", "value": "T10C254C3D297246D2D078F77089D24830B6DE4542332BC8A598E6E6D23F41A976DCFADC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855763, "uuid": "38fa7654-c569-444a-9ce8-b4827c4fb3ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855763, "uuid": "fd4d8cb9-6b88-4eb1-9737-20d54be6de1f", "value": "24576:74htduZCQVb8vOztLHKNu+A+/1bcrPLC/dCEZScMvBJyBtm8aatL71:k80dFz8BJyBCKX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855763, "uuid": "b67e2be7-cfce-4588-87f3-1176ca459adf", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855763, "uuid": "c6afac74-976a-461f-b103-2b9e7ad8348c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855763, "uuid": "39ec5685-79e2-4f42-8c4f-d582e7cd583d", "value": "SFT098-434 COA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de20515d-a749-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675817121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817121, "uuid": "1719232c-96f1-44e8-93b3-cf66a263c874", "comment": "Malware payload (GCleaner)", "value": "51b5b88736a1c62a3464beb2ef9eb4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817121, "uuid": "9c5b0991-3a66-4ea0-9a0b-be8729d3ffc8", "comment": "Malware payload (GCleaner)", "value": "2dce8e0c571b034ead04499dc43ceb83a82be396149dba1ee97ee2637919b732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817121, "uuid": "c747529b-cc39-4da4-ab6d-2be13997ded0", "comment": "Malware payload (GCleaner)", "value": "aca114591bfde9abc26132366542ec26ec5bfc30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817121, "uuid": "d059ffb6-829a-4c9d-8681-e424a81dbbfa", "comment": "Malware payload (GCleaner)", "value": "2a6c28d5dd83df4ee73dcff409c6a94a1828a483358cdeb0ecc79d4db0fef59c2eee9913ec8519867ebf456adc791e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817121, "uuid": "de474e9b-99dc-47e4-8b50-0eb72b8880ef", "value": "T10ED5E00A5D94D0A7D2608F70C9C72DF68C12DE6FE8BA41A713043FFBB671246E846979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817121, "uuid": "d86020b9-6f43-4590-ac22-5dda5e05ad5f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817121, "uuid": "92fe5fb3-5b56-4132-baf8-3a149ddf14d8", "value": "49152:wDEOaHlinbOVR42fkfGFQjiv5EMvcZtuBezVuMZg+UGjfBJEd1ALCgv2MR:+EOWCaP42MfpEvBYVuM2j8BY1ov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817121, "uuid": "9cdc93d1-d251-4c11-9c2a-ffc957ce20cc", "value": 2751766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817121, "uuid": "61d326a6-406d-4add-8e9d-c9ecea579835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817121, "uuid": "385b2b2e-1bf6-4515-aa76-d48a72c7cdc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c555e0c9-a804-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675897396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897396, "uuid": "147a6569-34fa-4f2e-ada0-4383a5bb688e", "comment": "Malware payload", "value": "6c3f7383edceda2e895eff7eb22f8c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897396, "uuid": "6c092539-e2eb-4279-8ce3-a58faa8fd851", "comment": "Malware payload", "value": "2de1c1a83f3a7cbe75e3a050dcbfc532cab256cdf89857295d7d95fee71d0d66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897396, "uuid": "37908246-748c-49ec-a142-f5114f3453d0", "comment": "Malware payload", "value": "3864bf09086f36bc02e972ab80eee7edfe0d6e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897396, "uuid": "76718404-6e3d-40dd-9d7d-de11a9894df9", "comment": "Malware payload", "value": "7fe4712a83358fc350aef33653564a3b76b000083fb6f7ad9a00d24bb307134b0c6ace3fe6228121b55bf60757408078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897396, "uuid": "220e848e-5b81-4301-8192-9bada4c1888d", "value": "T1ACC5127CB505C4ADC290BEB48C3A98E75CD66EE3D8E4A42370C93F3F92B91589A0D157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897396, "uuid": "b3d0b259-c93a-4f09-a22a-12fd43b41db9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897396, "uuid": "6e409072-708b-49e3-99d9-1b8ffb9e185c", "value": "49152:rdHhTIlOgS7SMW6PGET4AJBAvr9xRaBmDBy1uS5LnFse+LCgv2MR:JHtIgF7dP9BCRaBaBmu2Leeev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675897396, "uuid": "32907d4b-2e1b-4d4d-9e69-00d2c9187e45", "value": 2705212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675897396, "uuid": "2b01d1ad-8fb6-4f97-b264-8ba53ef165e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897396, "uuid": "886d40fe-7a79-4aa0-b186-b44dd8fbd4aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4805455d-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675855954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855954, "uuid": "6ddec1c3-d53b-4e32-a907-c400850f0351", "comment": "Malware payload (Smoke Loader)", "value": "f5c5baea8eb104af7035d8f579050a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855954, "uuid": "72ddee7e-3767-49ae-90e4-8a4f6e719a5e", "comment": "Malware payload (Smoke Loader)", "value": "2de2d13e9f0a9976e2e7ab06787248ca13cd1bdb0f7f31fdd3c121d8459d0f06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855954, "uuid": "3d392e52-949c-47e4-a57d-893528353347", "comment": "Malware payload (Smoke Loader)", "value": "109d2af53b436636353cb11491abee09296368e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855954, "uuid": "40da467e-92df-4115-9bdf-c5723838b617", "comment": "Malware payload (Smoke Loader)", "value": "6c05d4f2abdb069e779a4ce03a4d438bd4725425f87075a149e7d84e0d4b235ec4a63fed7e0bd34921622c33bb26d5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855954, "uuid": "1ddf958c-bc3d-4bf1-8bd4-fa6866e5d6a7", "value": "T196643B53A3D17C48F9258B73DE1FC6E8F61DF590EE4A776A3218AA1F1870172C563222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855954, "uuid": "55f8f6ed-11c2-4524-a8fe-90632f24f0f6", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855954, "uuid": "1d5ef805-9752-4b5a-94e2-10793bf42b25", "value": "3072:mwwq8eNGtRlyb7KbKqKNLwE2PCDh9+UNkn7q+kpWByUAl1j3BWnU:mp2QyX5RM2hzknFkpWUj7In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855954, "uuid": "3ee5adee-3886-4cf8-b4a2-3085fbf7262c", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855954, "uuid": "c856fcaa-8197-4055-b95e-267c5e53b178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855954, "uuid": "84a649e2-ec62-4343-92d0-2528d71266f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273c1e53-a7a1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675854610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854610, "uuid": "93cf14cc-4845-4fa3-a0f6-3ac31eb3cde3", "comment": "Malware payload", "value": "4c8406454ffdee51c3816562db21e8a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854610, "uuid": "fb56af78-61a2-454e-985e-73d1d66b209d", "comment": "Malware payload", "value": "2dfcfe703b45de9e5465c018b3c7378e90ae774542aaabb600eebe823a4eb282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854610, "uuid": "372b1ba7-9d1e-46f4-8fc0-3d487b4a5ec9", "comment": "Malware payload", "value": "d04928c6e80b5452f7d84d05cce351e662fc787d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854610, "uuid": "b30283f0-4426-4d90-82dd-08bb4dd562ce", "comment": "Malware payload", "value": "e7ad5add67e309daf09a8df6d5d997ade44e4cc07fa5a94dcaccb3b639779d6f983714daf9605537a181300e9bb32283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854610, "uuid": "68feaa7a-6a49-4123-a62b-74eb62dd093b", "value": "T16EB36D1078C19876FAAB1AB13460CFF4987FFA354B745EB723A4913A1F606E00525DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854610, "uuid": "9d3a0858-563c-4982-8112-ca279ea53344", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854610, "uuid": "d03b40e5-f472-48e7-bb41-c144a96fc533", "value": "3072:Z1t+6SRj/8qmzK6FzOyt/z+5nxPmb8rxzCuVwC:fQ2X2nxNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854610, "uuid": "40be6a98-5d99-4e4d-8751-22940153d137", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854610, "uuid": "7a57bca4-44e1-48c5-a740-05994fe697b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854610, "uuid": "ed0d18cf-dc66-4acd-b1e1-bc4823e23844", "value": "2dfcfe703b45de9e5465c018b3c7378e90ae774542aaabb600eebe823a4eb282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebca32e-a786-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675843349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843349, "uuid": "cc8a04c0-490c-4728-b14e-6846c5851e63", "comment": "Malware payload (RedLineStealer)", "value": "b474e470658589bd553b558636ef5acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843349, "uuid": "9197793e-67ca-41a8-a68f-6eb4e72a50bb", "comment": "Malware payload (RedLineStealer)", "value": "2e97ac73068b42ee9c6b5b5eba689eeb19b16af0c0269e43b8b48a087a2d25be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843349, "uuid": "c603d992-b3be-4c89-83dc-9f44a5a797e2", "comment": "Malware payload (RedLineStealer)", "value": "7cadb3ae055b8cce5cb890930594b1c4bf429366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843349, "uuid": "020d9a9b-bf5d-4ebd-a9a8-647f313f698f", "comment": "Malware payload (RedLineStealer)", "value": "96722a6482a42f26add2e16af1f4793a928588fbe0a15506e3b612d151b07b8ac7477a2833af42f6c702e6e87530665f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843349, "uuid": "7de23d37-6e27-4bf7-a5de-6d781b6d9358", "value": "T19A947D13A3D17D48DD15CB73EE2EC6E8FA1DF550EE4A37693218AA5F18B0032D963612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843349, "uuid": "0e7468ed-87c8-4ed0-aaf8-8c69db8c65dc", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843349, "uuid": "cccaec16-3848-4f72-852a-21ad49313033", "value": "6144:jG+PUCjCRXgoWnVeBvVdgJucIWUjlQIu:jTPGf2VeBtdxKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843349, "uuid": "1c3d383a-7f67-4be0-9509-919932e8a501", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843349, "uuid": "5231fdd5-3000-46cd-9d6b-44b5f7812245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843349, "uuid": "76cbac4d-c14e-4dbb-bf0b-7da1d005fbcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bcdaf9-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675883146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883146, "uuid": "038eabaf-4895-4bd0-9c6d-02f9d7755f13", "comment": "Malware payload (SnakeKeylogger)", "value": "f49028a451c11ab6a31e7e705118fd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883146, "uuid": "0f89d6f1-715b-4f2a-86b1-0b3f1fdc10d8", "comment": "Malware payload (SnakeKeylogger)", "value": "2f62e1108b56ac73c035abb0cacd3b297cdfbd6f2315bdb94b3cef882c5405fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883146, "uuid": "72c3cc62-fb80-4a74-95e2-d9c956cfeb4c", "comment": "Malware payload (SnakeKeylogger)", "value": "5bb2afa7d0277ebf64d498d17ce157841aee57d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883146, "uuid": "1aa45196-c641-490e-bdf0-8fe2dc489283", "comment": "Malware payload (SnakeKeylogger)", "value": "4764def8a379df6bf5287281197049c12edcc9a5394f39dacd4957bf09da1bb0c060706dc0636a9fe973dcacbe587594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883146, "uuid": "d54dc10b-5592-4e71-8c92-13930ee7854f", "value": "T1090523656E66FF31E7284BB3C822620106F095567297F24F1FCAE4E719B77808161BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883146, "uuid": "666bd2bc-229e-45e2-889b-af7119ddcc98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883146, "uuid": "1a4f73bd-fab8-4abe-872f-64685312d1f8", "value": "12288:Co2iaNA4GQ0bxzp8Vnx1B8zYLxq9C00yEFlac2Sfom9j0t07vCaedAwQPME3neF:Co2iwAnQHaC0JErac2qoW0emasO3neF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883146, "uuid": "fc7dcc6e-c190-45c3-8f4c-6376dfb8a2e9", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883146, "uuid": "c16c75f0-1ffd-4945-8792-4691ccc17b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883146, "uuid": "86154797-fd67-47f7-a774-a1dc92f72bb9", "value": "f49028a451c11ab6a31e7e705118fd22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fae2f21-a7ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886005, "uuid": "e8e2d367-ee4f-4a01-afa6-8e794cd8ae69", "comment": "Malware payload", "value": "e7d509bbd3a52a43acae27cfb9cfa6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886005, "uuid": "d9d948dd-2481-41b1-8213-f790413b0b12", "comment": "Malware payload", "value": "2f669834b747a10dd2acfdb99da38b5bf12f772a438807d1155e49c518cc62de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886005, "uuid": "abab9694-a38b-46ce-8691-e79128afdef8", "comment": "Malware payload", "value": "2af26db8dfc92ee1a3e78dd56c4d84edab27d071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886005, "uuid": "af198f11-545c-4586-bf85-910b651095b5", "comment": "Malware payload", "value": "2cfacb2e701279bf5b598a6010f46a8390e7edce79482f699b67ef789f1d55d06d074c28114931be5c551a3c65b98461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886005, "uuid": "15c366f8-f8f0-4492-8683-725713ba4c5d", "value": "T133641803D2E27C81F9658B769E1FFBE8765DF9608E4AB7663218DA2F14F0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886005, "uuid": "9b3a7adf-626c-4f16-a055-3ca22407edab", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886005, "uuid": "98cb31b3-2d8e-4e25-88e9-2c5f173bba21", "value": "3072:NPgMk9urzxR9+v9ahpBcdta0V9D5MO6+hqM6EsWQDiuLpYjbjNgvJ:Njkc5ZczrV5MO96hLiqAjGvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886005, "uuid": "a6c41cee-81b9-4bf8-9b43-02f99f399a48", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886005, "uuid": "af8ecdc2-24e3-4ab7-be8e-0357bbb71e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886005, "uuid": "60ce6516-dce6-4e76-a41c-7959308f97b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94087f4-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675881994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881994, "uuid": "32ce8699-df8e-4ae8-802d-bafb41689ec8", "comment": "Malware payload (SnakeKeylogger)", "value": "423cb81a6a34150f52d974f0b5ad7671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881994, "uuid": "99c21dac-9aba-4132-bfb9-4e93ff4cee58", "comment": "Malware payload (SnakeKeylogger)", "value": "2f7fa88382210dc974ad20d7dd204655d5321cb220f7507bfbe57577c767d66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881994, "uuid": "89ae3d4d-fdc5-4415-aacf-60d9004c5166", "comment": "Malware payload (SnakeKeylogger)", "value": "1edea836f2138dde98aad41beb959894abc9a7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881994, "uuid": "cb5ab697-97bf-44a5-9f43-f889f074b749", "comment": "Malware payload (SnakeKeylogger)", "value": "1c47d4c8d54ba87b655770d9889773d0f7c877615b17105aa2073a5b121e3f690cff76ac551a23123ff2261e890403b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881994, "uuid": "66f0771a-178f-4c0d-af26-bae367ffb249", "value": "T11D1512516558CB90D028477DD8B29EF093B87EB9E8A4EED72EC57DCE3A3279140406C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881994, "uuid": "53401a97-560b-4ebe-b56b-5c8a02adfca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881994, "uuid": "77e65594-994c-4833-a0fb-3274ae6b0e2b", "value": "24576:A1bgzPGhgzfYbOMv1ZhLhJEX6C2qQ4fqqYW3wMYeT:AZyPyywb1vNEKfd4fqVW3wMYeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881994, "uuid": "2e241161-3bf7-4aa9-9ced-d322ec8bc7cd", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881994, "uuid": "07ad0e06-4bc1-4e06-b5d9-1d08a969e536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881994, "uuid": "127d46fb-20b8-4a0d-911f-f61dc7152e5e", "value": "423cb81a6a34150f52d974f0b5ad7671.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90057af6-a80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675900313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900313, "uuid": "b77f59d5-3b6b-466d-a1b8-cac27377e895", "comment": "Malware payload", "value": "1d554df3d9de38b7d10edbf6e23300ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900313, "uuid": "34413758-e83f-49c0-8643-69ebe0a9655f", "comment": "Malware payload", "value": "2f8338a3728ffd178dc343675a364762538892b3a5f37eb0ec089e697613a188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900313, "uuid": "4e41baa7-9db8-44f0-b46d-759da564c944", "comment": "Malware payload", "value": "30474184ee69bdd0c688a8ea9671705db7e284e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900313, "uuid": "0585b582-65fd-485a-84a0-e217b833d20c", "comment": "Malware payload", "value": "bc7d18a80cfe7cb62ea4a6a4abe19d5e71c2fb18322e4f2c150a0c82517782d133daa19172f4a532c2971613fadaabd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900313, "uuid": "3eb5bfc1-4bc1-49e3-bbea-9ff325543477", "value": "T134C40207A7EC5122E87167B019F613D30A367DA16A38C36B335FAC5A18736A4743277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900313, "uuid": "07521806-5092-498b-be1c-f73d8c677798", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900313, "uuid": "998f2f02-6388-44bd-b0c8-5e7a236a6809", "value": "12288:2Mrdy90Et4q2aYy7MuXSFEWRjyTC15g3oSuO:zyj8iTyP/by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900313, "uuid": "367c17d8-bea0-4bfc-a5c7-ce446a6ce0a2", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900313, "uuid": "e14f546a-e838-41f4-8f7c-86d3d9cff8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900313, "uuid": "c49f60e2-f976-4001-96ec-3ed42ed975cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3364587a-a7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675874817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874817, "uuid": "a56e698a-89c1-43a6-a81b-245b791a9589", "comment": "Malware payload (RedLineStealer)", "value": "ebabd0e513cc697aa6c20f77cdd1d6bd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874817, "uuid": "65328289-45d4-4de0-a771-cde1417bcf89", "comment": "Malware payload (RedLineStealer)", "value": "301e03f2bacb09a40a2940cd97007bafead7423371718eff54819b5072855c03", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874817, "uuid": "b6cf5647-2c61-4662-b890-81bf7e8e77ed", "comment": "Malware payload (RedLineStealer)", "value": "09b1866de76615b890d32b09e6f62463e940c866", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874817, "uuid": "acee480f-cfe1-42a3-8e07-41063891637e", "comment": "Malware payload (RedLineStealer)", "value": "81433ba6e8ef78193f7a858b342300cb16ed8a7210f39b3682bfbbf011d2950a5a991ec38460284bf0d3bb055fccbe31", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874817, "uuid": "7afb627f-af23-4efe-b717-59d8550c118f", "value": "T1DB7301799E52E9B4A5F7A63D02EF6E5BF02110B93F38F3CA180D58D645D8D4E68420B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874817, "uuid": "32d81663-7404-4e86-a95c-8bc8b479de7a", "value": "1536:NW4m5BYFukrMWhNg9WgY/0Wrxe76J5qAPQt5vUaRf:gzK8WPh/0SdPCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874817, "uuid": "306658d5-25de-4cac-a3b1-0f49643d643a", "value": 79265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874817, "uuid": "524013e5-c9c6-4e3d-9823-d57730f06c35", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874817, "uuid": "e0521669-b060-4fd6-868a-50925bddbc62", "value": "connect dbase.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f048030-a75c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675825122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825122, "uuid": "9386e2ff-bdf7-4abe-b070-2cfa4fd4ba70", "comment": "Malware payload (Amadey)", "value": "ea71e7d3f35daba624e730170df691be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825122, "uuid": "5cf754d8-30a7-4a86-af5c-39fb94be17d4", "comment": "Malware payload (Amadey)", "value": "3042be5456cead621b21ec23d98d63f4ea06ca8d9c07a975857d1450bfb5136a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825122, "uuid": "c08e76fd-efd9-4c5e-b05d-43859d714097", "comment": "Malware payload (Amadey)", "value": "b29453d104691d6fd6b780f02834f926f39a1727", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825122, "uuid": "511c555f-ea2e-40c8-aae2-f7a9a4bf3b26", "comment": "Malware payload (Amadey)", "value": "a296ad6d03caf221d62d9cf00561ae27fc7396f7679a80c72578e571ae27e22dd8fa8877ea3111f3dc1def03ba7ca88f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825122, "uuid": "98833bb0-60ad-4368-bb35-7d6453909ab8", "value": "T145B4024BF7FC8022E9B56B7008F702D30A37BD609778838B625E6D2B18B2564B535767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825122, "uuid": "c5a38b70-7c09-46d3-93b0-8cc646c73f11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825122, "uuid": "9dadbfe4-cfff-4035-af4f-0b47474d1940", "value": "12288:WMrPy90B5qL+JX5C4cPVccZaajjoxL5NOFvGh:NyosmX5C9ecUajmdNOFuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675825122, "uuid": "6a1efb3a-3b0b-4841-b4cb-51a95263cbdf", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675825122, "uuid": "265270fe-e825-40f4-8d58-bcc5da6ad8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825122, "uuid": "aaae13b3-5e16-4b06-9a51-cb692ee61f50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d77d4c-a7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675869645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869645, "uuid": "7aa5ed9d-b75d-4fb9-b912-16ca14d4d8cb", "comment": "Malware payload (AgentTesla)", "value": "430585c3dd07b1071d70619af5b2bd62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869645, "uuid": "9711d934-813f-4b1b-99c5-dbd8b3f27109", "comment": "Malware payload (AgentTesla)", "value": "30a048a3f93b34395bb9434b964316d20e952ca857bacdf254001418ebbc6655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869645, "uuid": "c51d79e2-dfd5-4773-8548-771a921bcebd", "comment": "Malware payload (AgentTesla)", "value": "06d992b48c60f2951eb11b029fdae1de8cd0f009", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869645, "uuid": "83802837-9f83-4717-b8ab-fcbd1425edd5", "comment": "Malware payload (AgentTesla)", "value": "ab30eb7b323f864f930365a1fc537c30c7371a0e30964ea751b573ff1ba56bde162418bfa07edc03e811b79535412ca3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869645, "uuid": "54183e9a-e78c-4462-806e-e41be5592e29", "value": "T129F4E43E1D7756E2E1B4FB7192D28520B5AD8182330BCA1A9DE6DBC07F012827ECE55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869645, "uuid": "13f1ca91-ec18-40b5-b3ae-5ffc1b047d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869645, "uuid": "7bbca3f6-9c35-4955-9f44-20fe396d8a99", "value": "12288:J6znKPb+HT0qE8S6S7ztLHKNu+A+/1b1jKoCAWgiy49+BkTzCq/3zP3lDLDslPqn:J6zKb8vOztLHKNu+A+/1b5KMZ49+Bcz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869645, "uuid": "2be3814f-4ce5-4b66-adb8-3e5b47b64962", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869645, "uuid": "bb3d23d0-0b0a-4c4a-84b8-afa5a8d796db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869645, "uuid": "8e3ab2ba-c4ce-4ba3-aa2f-87356e0de96c", "value": "PO#88224, 88224-ADD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4208a9f8-a766-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675829315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829315, "uuid": "66cc907b-cfe2-4bb7-887b-31ab908b3f82", "comment": "Malware payload (Amadey)", "value": "e77f3644d499333783ffe2d83f2a8031", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829315, "uuid": "9d4691a0-ac40-47c2-8090-6570e9533207", "comment": "Malware payload (Amadey)", "value": "30eeafec2d0ff9d7aaf0bd3546ba54113d19100aaa4e23eb33ace4a6eb234321", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829315, "uuid": "9fc0279b-cbef-497d-bffb-ff3ed9db8b14", "comment": "Malware payload (Amadey)", "value": "3656c60d0af6424dd6fcd39e1e76981376caec7d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829315, "uuid": "e40a151d-ad26-4af1-8617-1dff7c578692", "comment": "Malware payload (Amadey)", "value": "521576bb8b199dfa4700821f63ee780545a1fbf6850ed005a7703a3dda3c4750ceba86ba6fc8d037eb2a96edcabf3e2a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829315, "uuid": "b40a3b69-1963-4aed-9560-165aa6782400", "value": "T18FB40207FAEC5423E8B157B01DF603D71A357EA05B788366238F6C5A4C726A4A332767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829315, "uuid": "8af03c3c-cde8-4df5-bdb5-d5d67f0332a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829315, "uuid": "a9f45ba8-f005-4b1f-864f-f3423fcb5403", "value": "12288:oMrDy90XOpxlN44FcxD9z1tJFECmRAoprwFOMfIC7iY:LyCOpxrByJ1tcBFMtWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675829315, "uuid": "79402682-6271-44f6-b702-43d69ef700bc", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675829315, "uuid": "3a2d3230-c676-4eb2-a610-dc54835fa4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829315, "uuid": "b654c337-2391-494e-8b21-c6516b4a30e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd436a-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675852160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852160, "uuid": "344846ed-1acd-4b3b-af8e-ebd78045089a", "comment": "Malware payload (Amadey)", "value": "75217ec8f6caa45f2ded23645d657591", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852160, "uuid": "3ce10f59-dc10-4972-9d6a-f9152092443c", "comment": "Malware payload (Amadey)", "value": "31559d735d95d57e11313cabb9b2f3a14de06d9c986ce78f6fa8d13c0f2b8ea9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852160, "uuid": "594d4fb7-3cd6-4dce-994f-0527d77425a0", "comment": "Malware payload (Amadey)", "value": "fc9c12f429f7fde4bda214eb0f86dc621873a589", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852160, "uuid": "72cad5b7-e96c-407f-a402-7bcf19f4678f", "comment": "Malware payload (Amadey)", "value": "e849f554ea15e83e7334ea6f4e36d91e222338df22aa63ad4717bd5386ca64bc74ba9bc7363338b2e689ecd7362c6dea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852160, "uuid": "b7690534-0320-40e5-8195-2f47f58ef9c1", "value": "T103C4020BF6ED5132E4B117701AF607C30E39BE915A7883AB220F6D9948B2664F635737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852160, "uuid": "105bbabf-29ae-445d-a7a6-649408e8b3bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852160, "uuid": "d6789e7a-30a2-48d7-8631-fafbca041230", "value": "12288:FMrhy90NEDXR8DeZ7lY8N6QSupnx9FeJGZsm+4NWn7:kyRLKDeZJYW6qnleGt+4k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852160, "uuid": "9dda8146-8c77-490f-9823-c22ba549c433", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852160, "uuid": "53bfef55-1789-4ad0-821e-0ba7c2fb5f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852160, "uuid": "366eb996-306e-4bf8-b0f3-d671123fd761", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21692512-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675867915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "86a2db9d-c6ae-4159-9e75-481881cc8a56", "comment": "Malware payload (AgentTesla)", "value": "e77c5a2790924a338b557dde709bac90", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "82dc1e63-f41e-4875-9bef-843d4abab964", "comment": "Malware payload (AgentTesla)", "value": "3177e77288cc168310b3d60ee25f9d5c4ec638816b012d9b71b817765576b033", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "5a0659d0-6736-4058-a319-4ac16a4e5b53", "comment": "Malware payload (AgentTesla)", "value": "d0b490963c92d3c77246ce731100b77e0b7e45f4", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "22a87d93-1b54-46e5-aad7-4b2d310d4e4b", "comment": "Malware payload (AgentTesla)", "value": "8d04de46cad9b6450a3b478e16c808f06cfe73f5d86630fa3c88fa4c6100549d034c5e2af8ef8cf2711385d1679b14b9", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "8df92314-ce98-4735-83bb-b7de07e67fad", "value": "T1C515E00663E4CF42E1A603BD89B2EBD017B36875D1A5EEC89CC26CCE4925B11B9477C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "c36f0147-bd02-4dd5-ba6b-74881bade5dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "c995e4b1-bcbc-41cd-8552-9920ed07f368", "value": "24576:elpDTptkR5txKi/nSqPxkWRceQh1AiiwMYenLlp:e78pxKiDnhwm/wMYenL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867915, "uuid": "3403679e-4a73-4a21-a3cd-70678cb81eac", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867915, "uuid": "cd483f80-7ff0-4db8-8767-184cdfe4df33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "a6a66476-5949-4b88-b480-42c15448c949", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec84d6e6-a7eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1675886724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886724, "uuid": "d31e13b9-a695-479d-a8d0-770798db7d3e", "comment": "Malware payload (CobaltStrike)", "value": "19db052e6618ce147a127bc807fd0631", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886724, "uuid": "e4317556-74b8-43fa-89f7-cc1c3f9699f1", "comment": "Malware payload (CobaltStrike)", "value": "322ea0b4fa978d8fbbfa4b3822191098e7bec953721e1cdab8a92901390ed2c0", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886724, "uuid": "80aa829f-8cb3-46f0-a650-e5e0b1853144", "comment": "Malware payload (CobaltStrike)", "value": "310fcd7390019180a22f3fbd792939d02c682be0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886724, "uuid": "9778d06c-1285-457f-9ada-bc065dc774f2", "comment": "Malware payload (CobaltStrike)", "value": "2573b67c5ec4da7386b40b6e302506c130103866773f054a67cf018e09818b9b4dfa5ae04528927e265a64b8a2cd316a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886724, "uuid": "6d1368bc-801d-4b35-bd6e-7d0ed560243c", "value": "T12C820A7EB64224E9C12BD178C9EE6771ADF27421417A271F2FB8C7302E21979493E909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886724, "uuid": "524f2422-795a-4d69-b2f6-3df99e47157d", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886724, "uuid": "d7d9fbd5-da00-48be-a9a0-cadeeaa27046", "value": "192:bDMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4InpfjmCBUbOj6kxiY:bDMAoKz6WtKEj7aBDiNnpKCbAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886724, "uuid": "2c963d9e-d522-473b-a021-8e83ef0b7d76", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886724, "uuid": "49dbefdd-8fe9-427b-b7b0-782623f387d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886724, "uuid": "cda1348b-24fb-4249-8cb7-6149a82b6d60", "value": "19db052e6618ce147a127bc807fd0631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ea16bf-a805-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675897502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897502, "uuid": "3e6e48b9-6329-4378-afdd-51c2af94d51a", "comment": "Malware payload", "value": "bcd3bec9073f02eb9e0b2b9c95a4a695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897502, "uuid": "a63dbec4-5ca3-46e8-9c41-8524efc62394", "comment": "Malware payload", "value": "327eb60b4ba301e75399d2eca0cf51d41baae63ce025bada72052e079221c6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897502, "uuid": "fb746d9c-d4d7-4910-98a0-f27050e11b9f", "comment": "Malware payload", "value": "2d7dcfcb3f6b6aa8704b714607fb8a1f1752712e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897502, "uuid": "fa40035b-ca9c-4dc2-a048-397dbf6977ff", "comment": "Malware payload", "value": "99e625acd5aa37bd3b44a20e599d795b41539f4ddbde63d55847ce3b41ee53b5120cac40be3a9f2a9ef8d7678f236188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897502, "uuid": "6dfa53f6-3cdf-4cd9-8869-5c5f7b5d55f6", "value": "T167C40217B7ED4533D8B027B01DF603C30B39BE615B789357268EAD6A18326A4A13177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897502, "uuid": "1176f4a9-7865-49f5-a9a2-91fe2b314d00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897502, "uuid": "b10c0cab-0819-44f2-97da-59020df5597d", "value": "12288:zMrQy90O4yASLsOT4QttLC6cRxeToEXWOJJlKiHYf:vyLASLsOT4SCDxe8EHlDHYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675897502, "uuid": "fd9bdfd7-b365-4d0e-92bb-1bdee0b509de", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675897502, "uuid": "4fb18bda-e5e9-42e3-9d93-168f96104ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897502, "uuid": "11955798-4a4f-4731-ad77-d16ac27907f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6aba67-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675880788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880788, "uuid": "96df4cd6-fadf-4e44-99b7-df4accc2dcc2", "comment": "Malware payload (SystemBC)", "value": "1cfd78420793c0fafebf0f4e1a09c1ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880788, "uuid": "ff304ddd-ae53-4459-8ae0-c5a8f5ebfa14", "comment": "Malware payload (SystemBC)", "value": "329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880788, "uuid": "13674ef3-1e71-4e3e-bc66-7435175059ab", "comment": "Malware payload (SystemBC)", "value": "8c6df311b3f42ffab51df0d411cefae923ef0929", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880788, "uuid": "103bc2e5-e7b0-4e90-9c33-e506f4eaf2f1", "comment": "Malware payload (SystemBC)", "value": "78533038f6df2e937ae953b4d734357b8fc00cc37150866823ef615c8979a17df175ce5968f2d0389ea9b6555a6b8899", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880788, "uuid": "dd60966e-2a24-4677-b46d-b32cbe5d1f21", "value": "T1995501410D226B96D2656575FA6F76A0B0C47FF2063087636F3A7DAF7F71382AE01284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880788, "uuid": "81c7a4f3-a4fb-481c-91ff-bb32a8ed7e70", "value": "a2833106949ae6e20c40ed0128f9df4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880788, "uuid": "c57e5275-aef8-4103-a60a-73070027b98d", "value": "24576:BB++leR75eeScNFG0tUDWlmulwI49SnymKLRd:BMseR7IexXM/ulRAsURd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880788, "uuid": "91ab1702-a649-43d1-b2bb-90eecf88f5b6", "value": 1282712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880788, "uuid": "b2e8392b-b27e-4138-8a5f-dda6afc91ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880788, "uuid": "eb0c26a1-ff6d-404a-b4e0-c9824ab21623", "value": "1cfd78420793c0fafebf0f4e1a09c1ff.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590be410-a747-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675816039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816039, "uuid": "610b77bb-d5b2-4683-a5b0-57ee30549713", "comment": "Malware payload (Loki)", "value": "bf9d5514112336ab60094ad3098bbc25", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816039, "uuid": "876fb1da-e191-46e8-b4d6-9a4f20ae4371", "comment": "Malware payload (Loki)", "value": "32c600a3406f52efc6a9abbc5498adbef9feabff7cd3f4a7cc43c01abd748bfc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816039, "uuid": "40c6efbe-7465-495d-a0e4-2680af5f5d83", "comment": "Malware payload (Loki)", "value": "aac0e12682cb89025ca8d458716b1113386e34e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816039, "uuid": "b08a66bc-a95f-411a-850c-34f5de6ba780", "comment": "Malware payload (Loki)", "value": "b216ed3bc641c8ff106988102e31b433c0fa8941c45b6ecf8183417ff6ff7a6f2ef39d42d45392aeb3894be3809fe0c6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816039, "uuid": "c5be92cf-5741-44ed-8ef6-bcacd869476b", "value": "T193724C901B9E90B1D268B533523A410D49FEF43734931AF5BECE986633BE10D59F91B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816039, "uuid": "707a0926-01df-4b84-9a99-fcce67848d8c", "value": "384:9kgu4sc1GPBpdcM0iEO1YDp1LeGMSelurq5gEAFT8:OksoGPBpdc1FpTMdurq5gEYT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816039, "uuid": "94b19e18-fa18-4d2a-bfcb-54e3e75364b9", "value": 16264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816039, "uuid": "4620434c-611e-4157-8e74-d9be48b24664", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816039, "uuid": "cdc82f17-0e90-449d-9cc9-12c32fb99328", "value": "bf9d5514112336ab60094ad3098bbc25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610ee232-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880907, "uuid": "4a266a14-88b3-490a-ba25-8d69f9e44d4d", "comment": "Malware payload (SnakeKeylogger)", "value": "b44cb97ca41ade38e961debfdd3cde59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880907, "uuid": "20d7f235-57cf-4a4d-9f08-b9855ea309f5", "comment": "Malware payload (SnakeKeylogger)", "value": "33bcce7757b23619ae945f7cd77c16c01001a2602d8fe8e843597e1fc5256c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880907, "uuid": "07d09679-7017-4636-89b5-159e360db8b4", "comment": "Malware payload (SnakeKeylogger)", "value": "6dde4188be9c762bc89420b4223a711c65512d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880907, "uuid": "1e13c90f-3525-488a-9c1f-f405c6d4962a", "comment": "Malware payload (SnakeKeylogger)", "value": "c83aca795f1b8424f7a88bcb819ba19ba267693e85443568f26579963c40833205c72fdcf4fac170aca1641f875c59f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880907, "uuid": "bda90152-e865-41ab-a3f8-c8915151b9d6", "value": "T1D354129821E8D563DDAB1E326D365B490FFFD916246C4B0307D06F8EBC622018D5BBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880907, "uuid": "c297d1d4-00ff-4b2a-9a84-fc83f96cb231", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880907, "uuid": "900b7577-4a3c-43ad-9f90-aa42c82fe6b3", "value": "6144:vYa6UZu9/8js4R3CtgcLns+80TYTl2iu1Qnq1t:vYq+/Wsd1sP0T42iu14qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880907, "uuid": "e4881dc5-9d4b-445a-bd4f-3f887a2263b9", "value": 285580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880907, "uuid": "40f59f09-677b-4ca3-9b0e-febe4b1fe22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880907, "uuid": "27891e90-bcb0-4e40-a352-b4ca7a528add", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f80dc1c-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675853953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853953, "uuid": "6ef055ba-3b5d-45b4-8481-ed05e198221f", "comment": "Malware payload (Formbook)", "value": "d511e5a0e42309e6148b3e7f6b9e5bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853953, "uuid": "ba449cb6-b811-4961-ad19-7dfd22f91ff3", "comment": "Malware payload (Formbook)", "value": "342215db36f2fa15a4b72d54cb4e7a7179462dcaab9dc9f791336df867d6d286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853953, "uuid": "abc507e8-bb25-4e00-aa35-71a12f6585bf", "comment": "Malware payload (Formbook)", "value": "858aade78f8463bca167656c81022f20a7535fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853953, "uuid": "0443f44e-61c9-4cc4-b89a-33f2e520f578", "comment": "Malware payload (Formbook)", "value": "c0eb51ea6977f39fb17c551ebc5ff6080f28132d5668a540c909b738c7b395af203707fe87ce130133707d2ba6726c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853953, "uuid": "778273ab-e29d-4317-a54a-96b1e917b161", "value": "T1DD05235D53648A20DE99CE31E0B9587A037BA61DF205F32ECFCA55DEAE37B840B81543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853953, "uuid": "9de87454-88ac-49d6-a963-06ae49175578", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853953, "uuid": "58ebb744-4b6e-41de-a04c-e5f7fd757f73", "value": "24576:IrxN5IC54TWMnp74YTKza8D7ajPhVoo6dlSA:Etgim8QeLmPIvdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853953, "uuid": "42d357d6-c031-4728-bc4f-1955a8db537f", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853953, "uuid": "4f210321-8329-43ee-9aa0-70327984229f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853953, "uuid": "40c982af-90f9-4c9d-b5dc-398e93fceaf3", "value": "Original Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fed6f8-a7d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675875759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875759, "uuid": "bebaa777-8bbb-498b-95e0-ee7c9cdd8285", "comment": "Malware payload (GCleaner)", "value": "504b43172b99082e417628e349361484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875759, "uuid": "e158327f-b20d-45b8-8176-09006c698f77", "comment": "Malware payload (GCleaner)", "value": "34364090eb7448d55caea6c01473df93664f60cfce55d0e6666cc6b385277854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875759, "uuid": "7517767f-6b7b-4ea9-b4c9-65d2335d5af2", "comment": "Malware payload (GCleaner)", "value": "cf87b2624c1bbf5077c545a167ed3ba072125afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875759, "uuid": "581bae6e-463e-45fc-b76e-0ee7c4b63dbc", "comment": "Malware payload (GCleaner)", "value": "031ec8af4a9eeb20bf5b9b1a8e075c7590efb68c26da02546bb77c984f445831b062cd9efd41bda863035b9221cd3e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875759, "uuid": "ddba0d4d-b86e-4d95-ab6e-5316ec93f317", "value": "T1B1C5127C7104C8ADC280FEB48926D4E75CDBADE7E5E4A42270DDBF3F52792849A19207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875759, "uuid": "28b9ac32-edc2-4cee-84c9-b5eaa41504df", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875759, "uuid": "b314f5bd-100c-4283-a825-2113ad762a5e", "value": "49152:rdHmFF/WWGLB9QM4e4A/+iZVLawgS7Z8q6olEGf9ZF9c1dprLCgv2MR:JHmFFdG374eS4YwT7Uo39Qpfv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875759, "uuid": "e2d28976-5d5d-4949-9947-d4f10c499713", "value": 2727583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875759, "uuid": "19487cf8-6636-4c43-b01c-771f5675ad3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875759, "uuid": "aa3bceda-5f66-4b3b-b904-32990c270e3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127e7ead-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675867890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867890, "uuid": "8cc2acf3-b2d9-49eb-9558-d6298153d870", "comment": "Malware payload (AgentTesla)", "value": "16ff63c1b025e03e993ecd04f9c81b82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867890, "uuid": "b163b404-ff82-45ba-a34e-e519e43b916e", "comment": "Malware payload (AgentTesla)", "value": "34400971737de1a9413dc4c09227e213e18ed094c81b92b99464af046f886e4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867890, "uuid": "34d99ef6-83c1-423f-8d42-45238893af6c", "comment": "Malware payload (AgentTesla)", "value": "aef0385147dc7913d05439156479bff40e9d241e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867890, "uuid": "21288185-3eca-4f44-acfd-a96315203dcf", "comment": "Malware payload (AgentTesla)", "value": "b2e550495a1a0d5b97ac47103b636eda8709655df66dc5ebb811337ad2df8e43019cd0a5adf13d9bdeef9fb89bc5e231", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867890, "uuid": "49e74e8f-22d1-4ca5-a7b0-ee7fb405c0e3", "value": "T1AFD4E33E1DB622E2E1B8FB6156E28420F59C8092730FC959DDEADBC07F015426ECE65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867890, "uuid": "5a3b6800-9c05-4ce3-9683-d17dbf8cea24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867890, "uuid": "497ee687-bd4f-423f-b194-88692d4d87f0", "value": "12288:dPb+HT0qE8S6S7ztLHKNu+A+/1bSeBif3BBDviw0r5q6xof7DSHn4/vCqN7CcpxQ:Fb8vOztLHKNu+A+/1bS933v0o6HcCwC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867890, "uuid": "21d6a405-76d3-4cd4-b973-8bf1bd6e8f9a", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867890, "uuid": "7930e097-f8a6-4b33-a15c-b54a5dfe0ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867890, "uuid": "39f312fb-bc12-4811-bc9c-cf0351d75093", "value": "Invoice for part shipped 00875122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740e4fc7-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880939, "uuid": "77e5ae12-290f-474a-bce8-a40f5784641f", "comment": "Malware payload (SnakeKeylogger)", "value": "96d7ef3761f9ffd11eb3615762795dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880939, "uuid": "36eacda4-114b-4425-89d8-6838736eea62", "comment": "Malware payload (SnakeKeylogger)", "value": "34528f0e5dfd0f89dc11e8ce6d4c983ba302876757fc5dc7031b50746dba53dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880939, "uuid": "a3df816b-0349-43b5-bf27-d5a720b9f164", "comment": "Malware payload (SnakeKeylogger)", "value": "3e2696b3fbdc2ff31053c824eb6aa386ac6a15b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880939, "uuid": "0c8b6455-6713-4a50-9850-6bbcc1821f4b", "comment": "Malware payload (SnakeKeylogger)", "value": "426c1a7a2038e3b5e0441315141df7906bfd25f1bc2e38000f8c0a79a185ebf4b50883ceebfe3427323692e720a25141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880939, "uuid": "d2c6c6c7-c4cc-40bf-9307-056ab9afe604", "value": "T18755A7343DEA501DF1735F799AE476869AAFFDA3A606A45D2050334A0B33AC1DCC193B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880939, "uuid": "4c428289-a0d5-4f68-9738-a4bbfc263e69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880939, "uuid": "6dd89f16-58a0-4abd-a461-4704c1d12d15", "value": "24576:oNuiWGLHHPrpg6+R445/51g+PBD+jtcrhgIBlrTjjBTx:oDTPrpg6+RB5/51g+PBD+jcdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880939, "uuid": "546064b0-369b-4d42-b5c3-694ed8822671", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880939, "uuid": "7dd8a107-36b6-4af0-854f-9982e0670d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880939, "uuid": "6ae054f3-b4b1-453b-88e5-59c38af16b54", "value": "3788333154_202302_BWO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e907dab-a75b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675824692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824692, "uuid": "78638d07-374e-4f6f-98f8-9e949600d7bc", "comment": "Malware payload (Amadey)", "value": "544cb56d125737366acce027722b2bfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824692, "uuid": "8a0c1346-cb31-4a9a-abce-8eb6e15636f3", "comment": "Malware payload (Amadey)", "value": "34708eacba5b74c9da90024d09d095da6da5be5a3b7ae036f4639921f817545b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824692, "uuid": "fb01f456-b3d0-4e45-a227-1a4428694052", "comment": "Malware payload (Amadey)", "value": "0845a6392623ff9a3a5c5b138f65f822aed1be1f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824692, "uuid": "8c3264ac-4865-479c-bd3b-a6ee61bfbe39", "comment": "Malware payload (Amadey)", "value": "5eacdb3cdb9d36f6a677b22cf1131d0074d153905da3af9155fc63dbeafe534482b081c1b518eeb622be99f0fcb4f60b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824692, "uuid": "d04f31e0-a6e5-49ef-90dc-69b0658f4364", "value": "T1E9B40247E7EC8162E9B1673009F713D31A36BD201B7893A7668F6C591C322A4A93537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824692, "uuid": "fc8b8b82-bca4-4055-8237-91884020f08d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824692, "uuid": "8c22658f-247a-43a9-b433-6a9c1086dc9b", "value": "12288:oMrdy90W4pFqMLi4zCyXcPVcgfaajjs2rcMtTmno:Vyh4pFqMZwegiajvLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675824692, "uuid": "c15ab9d8-5a40-40ec-91b8-d88a3c869b30", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675824692, "uuid": "ce344b3d-394a-46bc-91b8-ef1b00d61f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824692, "uuid": "b2b806c2-4943-462f-90a3-aa1c9892fd14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26de3a81-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675846879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846879, "uuid": "b752c56c-7ac2-4336-b515-f13e8dea0ae5", "comment": "Malware payload (AgentTesla)", "value": "93c3106881d40cd387fa824efc669a4e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846879, "uuid": "f058353e-88fc-40af-80a0-8db26dabf145", "comment": "Malware payload (AgentTesla)", "value": "35cbaa7ff14c656197e3b9d779a68c37b8d3d286b4e129ef00eee4f2e507cdaa", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846879, "uuid": "58119f4c-c00b-4c95-a4a6-94e1acaa4c30", "comment": "Malware payload (AgentTesla)", "value": "d2f860f49a4ee52609eb7a955a60854ead79bc10", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846879, "uuid": "32ec34cf-2cb6-468e-98d3-a3e6d52bf39e", "comment": "Malware payload (AgentTesla)", "value": "f4706c7f4dd2f5182de34388644c1e5cd81d66b0cada8891ba95888454ae9b37a3fc7a1ae088aaa535aa705be953e4c5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846879, "uuid": "6a18204b-3070-434a-beff-06eafb185e6b", "value": "T1E2A423BFE0D5ACF85C9684A9523D7014E272465441ACC6285EC57E2DBFC64CCEDBA30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846879, "uuid": "bf768805-508c-406a-bc7d-41a7c6f88f0f", "value": "12288:zjjDnVpJ9qwL5hHufPPugO8pyO2tapMP/h:3jDVmnugO8pyV46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846879, "uuid": "9ad868d6-c64c-4431-ac34-c96058ab6360", "value": 449440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846879, "uuid": "d048ad2c-1f2a-48f8-87bd-dd58d0928007", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846879, "uuid": "8a0a647c-6714-497d-806a-8c33ad4688db", "value": "Commercial invoice_0065224511.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a0003c-a7d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675877376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877376, "uuid": "31d11d90-e632-4770-b770-093ecadd58e3", "comment": "Malware payload (Smoke Loader)", "value": "1af7fba9940a6acec25a61e647a1ac9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877376, "uuid": "38958db8-2bff-4a05-b54c-c49e51cb18c6", "comment": "Malware payload (Smoke Loader)", "value": "35ed81fb323d14125ca612f83175ee9611bc71c9b5662bd9e175a08339c03826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877376, "uuid": "c697d84e-1f0d-4443-8af1-96d196b3db37", "comment": "Malware payload (Smoke Loader)", "value": "9932fdfde0aab9f5af62bf52d8c8e8248e338bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877376, "uuid": "60cb2503-c770-43ac-a347-2299c664a87a", "comment": "Malware payload (Smoke Loader)", "value": "19e60d8dddde5f1dc205ffbe290bf800d06591ece513eed3457bc552f48190aaffe6ef6ce2e95241358205cbb850c50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877376, "uuid": "b7c11500-2236-4cb6-be0a-8328b25b1cd3", "value": "T155641A03D2D17C85F9268B769E2FFBE8765DFA608E4AB7653218EE1F14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877376, "uuid": "935e8cbc-6535-435b-af37-7ab48769aac4", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877376, "uuid": "d615c555-e5a9-4ab5-ad02-d5ee26ee5834", "value": "3072:zPgddVrNzxR9tYYjZjws2JJUDD1dIYyYdizCf4DoE6sWQDiuLpkHlvJ:z2dL52YjZj9fbyBCf48oLiqkHlvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675877376, "uuid": "94fb79ed-7cf8-489a-94b6-5007c5e6e753", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675877376, "uuid": "ea262387-d346-4345-a68a-cc744765e717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877376, "uuid": "22f4c52e-cb33-4381-9418-a66da90d17da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9916f8-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675881414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881414, "uuid": "472e13df-dcbb-4ff5-ac0d-91167b259bbe", "comment": "Malware payload (Loki)", "value": "285a89c80adb7aaa99bcc5520db5d157", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881414, "uuid": "259458bf-27dc-4c6d-a65d-f94cf43f5c54", "comment": "Malware payload (Loki)", "value": "36047edee76991abf7488230ee76595be53542c3c2f994f1256f00ea5e56ece6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881414, "uuid": "6a80914f-ddc5-4907-96f4-9b58e425bf0a", "comment": "Malware payload (Loki)", "value": "24dc77157ef3917920b4b97fdd9ed1ab25ee110c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881414, "uuid": "a93ede3b-406d-41fa-a0a7-ba5f97010dd6", "comment": "Malware payload (Loki)", "value": "73f04d0da35f5ddcc572583f3dc346b027e48a9d8c79f2bab9e8f42dd322b8c380796151be95b6301a8c642303f61cae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881414, "uuid": "6cb48bf0-feb3-4984-9ab2-335182329d10", "value": "T1D603C31AE78F02A8CB4102B3671B0A89A6BDB33DB36155B1345C9374339DC3E42766BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881414, "uuid": "20d14543-be9c-418c-a34a-c5e7ff07ea4b", "value": "768:XFx0XaIsnPRIa4fwJMyy2nMOzmoT0N028m5CJaO26maSVX:Xf0Xvx3EMZ6MOz5c35FO5/SVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881414, "uuid": "a8aa3c75-e020-43bd-bc8c-8874f7fdb61e", "value": 38155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881414, "uuid": "dd630649-7c87-483a-96f2-d6eda51d438f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881414, "uuid": "feb0374d-f409-45b9-bcd6-efff7dbba44b", "value": "Sales Contract.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a541efea-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675882310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882310, "uuid": "192c4108-8f33-414a-a98e-a4faf4161dc3", "comment": "Malware payload (AsyncRAT)", "value": "637fad9516c92a457f17809c9732a9a7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882310, "uuid": "a99c0706-9835-48e3-b028-835e2ed3e754", "comment": "Malware payload (AsyncRAT)", "value": "360e29b66b74183494f32501a184eb3f39b425459b57cf84a6e3f8061dc519a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882310, "uuid": "b9d5aacc-e5c3-40e3-8003-edaea0b9898b", "comment": "Malware payload (AsyncRAT)", "value": "98031ba195177f05b98d0e73be2c705697865062", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882310, "uuid": "eef0a521-5b72-4f3f-963c-63f4a59a4f99", "comment": "Malware payload (AsyncRAT)", "value": "50dd1f6c2017dd78baa1366de78238f2af3b9d1051f8ba8bb8092103e228ab7fcfaea48c7633e2434b7d0fd6387f8e77", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882310, "uuid": "0b49dd0e-d96a-4a3d-b78f-dcbd9da43f73", "value": "T16541BC141BF20324E7F38B39A8B667148A76FC11ED268F8E028495885C25520F539F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882310, "uuid": "a47397d3-f403-45f5-9e55-0c816301b876", "value": "24:8sGBJI2wpqKuXW5UlA7W+q+/CW8UMkWLK0PEFd464Dfw4o08XenQOHNYenQOHNYh:8bhw7COFMHLPmviod2i2Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882310, "uuid": "1c364e5d-226e-436b-8a2c-2fbd4daf27be", "value": 2368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882310, "uuid": "a2dadb40-f86f-4209-a061-f57d3f59f30e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882310, "uuid": "eb25223c-da96-4acd-a57c-449f2a35fe2e", "value": "\u0414\u043e \u0432\u0456\u0434\u043e\u043c\u0430 \u0440\u0435\u0454\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0456\u0432.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2e85cf-a7ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675865304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865304, "uuid": "54d0ebbe-3fc3-43a4-a763-4b80f3d6f746", "comment": "Malware payload (Amadey)", "value": "a70bc68eeee0816d57c65f3015cc1d72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865304, "uuid": "ae57cf13-09c0-48ca-a61d-7639f5233f0e", "comment": "Malware payload (Amadey)", "value": "362443634a4c54b943286ee82bd763eb21b919ef5746d783cade91513e9b031f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865304, "uuid": "63baf568-e953-43fb-9a35-a6cd8a1db1e9", "comment": "Malware payload (Amadey)", "value": "157e027bbe9c4713dbedb44878108a3026aafcad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865304, "uuid": "df61d32b-4bf9-4046-9884-ed1e621d1017", "comment": "Malware payload (Amadey)", "value": "4c8f6a41905c47c556035775a0c8f9c9b5c426a81972c92554690a876270bbff0c9d7e78f5fbf5ef52ee3e37babc3643", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865304, "uuid": "daee08cd-215a-420f-935f-3984ea627476", "value": "T18BC40207EBEC8032D4B4977069F603D30B36BEA11B39975B274A685E1C32674E63572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865304, "uuid": "37abb1da-280c-49cc-8d63-07fd1def1d1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865304, "uuid": "d5db814f-44d1-481a-8523-f7710f8782e3", "value": "12288:KMr7y90j30n/3qe3fczTGvicB648EarSa5bmAMGbyN8yu:pyU0/aePczXcB6+da5bmA/bw8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865304, "uuid": "0bf16aa6-558a-44a2-a630-3c9524cc200c", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865304, "uuid": "f32c2cd1-dbca-4233-abc8-257b706b7e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865304, "uuid": "9c15d0cb-8ea8-4699-8678-0187b21c99a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72065976-a7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675858172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858172, "uuid": "3a0a198e-cf91-482f-af66-36facd72fa6c", "comment": "Malware payload (AgentTesla)", "value": "f0df3f64cd9ebf1a531f4e8b5dec03be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858172, "uuid": "8eabd84c-5da8-4a86-a320-b834153246d3", "comment": "Malware payload (AgentTesla)", "value": "3652bafc6040261b1ee34d360ca1f2a28277a258e9ed843ff0b8c846df58f8ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858172, "uuid": "236dccb4-b0fb-4d4a-982a-6f957b2a652f", "comment": "Malware payload (AgentTesla)", "value": "f7ccc908d93b1ac35772d6b0828483bf8a228b96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858172, "uuid": "418f108e-323f-470f-b1ff-b50e342861bc", "comment": "Malware payload (AgentTesla)", "value": "dc6e2f7bce3805cd2b7a7cc08af9eb6ab1d1d94ccd36f3baa2dd0175bb872e54550dd371c45b96acc2952a8305ace1ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858172, "uuid": "9031cc4a-c598-4272-bc49-0af52e0ea486", "value": "T12464223DBBB1C112F85E1B312CB12653AF65ED6268F4978783005A747D98EC04E6E3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858172, "uuid": "2cf28e94-ae71-480d-81bd-27e7106feec6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858172, "uuid": "35d6d56e-1f86-4919-ac4b-2db3cdc624ad", "value": "6144:vYa6fi4AuazCAnfpQ/bx4S6RLvnNGVsGe6Q67wX+2j2ZazCJMG:vY1i4A3zCaQDSSMvnNGVHZQiwX+2BTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858172, "uuid": "1a6cf8a0-2ee2-45fa-add5-6c4511aa4c37", "value": 326193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858172, "uuid": "be52324e-dfba-45e9-b144-98c96eb31468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858172, "uuid": "964f7e3e-aead-481c-854a-e0cdce336bf3", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7441b7-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855931, "uuid": "d338773d-ad81-4824-b89c-c0225de61727", "comment": "Malware payload (AgentTesla)", "value": "ee090902fb4920c58cc576248e8a5091", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855931, "uuid": "871bf319-8ae6-4ee2-9437-27541c257c89", "comment": "Malware payload (AgentTesla)", "value": "36e9481a46d437bb1c8fb4c21c6834f947fea982a394245a61e6e850e04cd046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855931, "uuid": "ef78b1f3-e034-4cf8-82d5-d6bc755ee630", "comment": "Malware payload (AgentTesla)", "value": "c06bcdb8321e56d3ac899a65500be2a121c3461e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855931, "uuid": "bd62429f-c2f9-4388-b473-ba3bcf415359", "comment": "Malware payload (AgentTesla)", "value": "77b68b3af829d5149596e437c8bac931469f198243c71c40a0533f19b74337a971376ce47de6aeb8df61361fcef43d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855931, "uuid": "306df688-97b7-4a69-9034-0bfd9c660293", "value": "T18505F1021967CD54E3A50E7DCAFD172887E98A8A13F3E33A23E501D5CE53BC7E416266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855931, "uuid": "047b56e8-aeb5-4b8c-ba17-6f460b838bff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855931, "uuid": "225f63c1-af40-492a-84ef-e0b55edb52df", "value": "24576:R/21nVPNV4Z4+kPIBZPEIIamIeE3lvX9cXPKT:R+pFNqOL+5uamIeylvXUPKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855931, "uuid": "0cbb7e76-2229-4b2b-8c76-e56e7d18837f", "value": 813016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855931, "uuid": "7984e8c9-f85c-406b-ac8a-98cdb4da613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855931, "uuid": "08158b73-5622-40a3-a044-75950c8ed40e", "value": "36e9481a46d437bb1c8fb4c21c6834f947fea982a394245a61e6e850e04cd046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053dbcaa-a7aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675858419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858419, "uuid": "c532cdfe-62b0-45cc-8e9e-7d36a9a5408b", "comment": "Malware payload (Amadey)", "value": "ec5df0708ce3022856f79456202b6ee0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858419, "uuid": "690da968-2634-490c-8eef-415f09478d22", "comment": "Malware payload (Amadey)", "value": "377a6aa4b4f369ba4500baa3fa5cbb0c34a04d78e819cd9928bf5fb8c83eefb4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858419, "uuid": "36989e5d-ee6c-4ad3-b428-3a2981819b7e", "comment": "Malware payload (Amadey)", "value": "b069ec4210b4de4c7a7adda7cb55b9913ea8e1ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858419, "uuid": "79ee9ccc-40c5-4e70-900e-a6ffff69564a", "comment": "Malware payload (Amadey)", "value": "b795c240e9fd5ba1a01793d73599920135ae8cc6b374231169bbe80a7fbdce2bda5f8698fcb537b0d708ff23153fd337", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858419, "uuid": "cd52509d-6c82-474a-ac46-bc2002d2a5c5", "value": "T101C4121FE7E89133E9F45BB018F202D309377F926A3883AB574F6C4919726A4A131767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858419, "uuid": "bf174dfd-5df0-486a-a3fa-a0ab8c078254", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858419, "uuid": "2e1cb1d9-aa87-43a3-971e-6e0963501e69", "value": "12288:kMrKy90mQ60z2bdp1ddhq4Y4CPxZlYnJypw:myC60zqDI4Yx/YJypw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858419, "uuid": "e7c6a5cb-02dc-430c-9073-8483effb7c8a", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858419, "uuid": "d540229e-1236-4d59-b282-6fa4888068f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858419, "uuid": "58ba72e7-625c-4ebc-b912-bc5792b07d4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18909b4-a76d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675832535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832535, "uuid": "96fc7c1c-75ff-4538-ba4d-2f35e56bff9d", "comment": "Malware payload (RedLineStealer)", "value": "8d51420e1abaf0cf102165664a7cb808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832535, "uuid": "782c6336-8768-48ac-ae2d-d66b732202f5", "comment": "Malware payload (RedLineStealer)", "value": "37f0f992e3e16d0809b798b114e6ebed4b9cdcedc6e99aa6467c08e68dc11c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832535, "uuid": "856bd890-191c-4b2c-8e72-c840b8babd2c", "comment": "Malware payload (RedLineStealer)", "value": "1122a10b2be00f31699daaabc762748479b089ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832535, "uuid": "9093da5b-85ed-4bc8-b471-83222ca14909", "comment": "Malware payload (RedLineStealer)", "value": "f23a4517461e468d5c3792113eb0f4195b6ccea2dbaca5b76b12d58f8d7a1dcb687796c394255220c706854be322abd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832535, "uuid": "1cc43b28-8838-4de7-bba6-4ed96ae56645", "value": "T1006401323AD1C072C43B64366CE4DB99EB7E79305176850B7B6807AE9F702D12776346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832535, "uuid": "ba7c720a-3b35-44bf-9909-3cc93239d0de", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832535, "uuid": "3e9708ab-aae1-4535-9cea-e84728dbb21c", "value": "6144:xawiFx6LqCAJwU/dBWPbFQPjDIkRyFAHcrh6WZ+55d45F:xawi76+CAJZqqHRyiHcR85u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675832535, "uuid": "7ebe0586-4534-4d48-92c1-9096989e1e36", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675832535, "uuid": "1a83eceb-4355-4a0f-a6c1-3cdaaf347f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832535, "uuid": "d03ca2ed-edc3-4de8-bb50-cdd483f3e14a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d8a644-a749-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675817077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817077, "uuid": "b8b68b70-103e-4e29-97f8-771b36f562aa", "comment": "Malware payload (Amadey)", "value": "b7eca894d0436b2e2947b18b0910df93", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817077, "uuid": "4187e4d8-22bd-4962-88d6-ed3595e0896e", "comment": "Malware payload (Amadey)", "value": "37f2417bef37515805193563810818af75521cc835ac1fbaec6e057a01961303", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817077, "uuid": "8f1e5a11-cf06-4cd4-8186-b3c5ce7d6291", "comment": "Malware payload (Amadey)", "value": "433ca0a3b2e3c3d14181369192cd584d8349c9f5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817077, "uuid": "f286c0fa-c1ad-4d8c-9c13-352bd659e84b", "comment": "Malware payload (Amadey)", "value": "9567cac2185c50c863f8262882060c4a6a38391a99c04577f43eb073fbfde3cc53cb2be8404c9991cde473c346bd37ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817077, "uuid": "ccc7bfc3-1685-4e42-a865-a284a06c7c80", "value": "T1CCB4020BA6FC5033E8A4477019F203D31739BDA12639875B364E9D1B18736A5AA3637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817077, "uuid": "5d971e96-0102-4aa3-bebb-f8d36c930da9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817077, "uuid": "6fe4ed16-c8cc-4fd0-bc2f-a0904fd0e939", "value": "12288:EMrpy90CkibL/blm1/ykkPRa2GJdd6cXWtG9wij:lyf17A1/3kPkJ9PXWtHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817077, "uuid": "5b0836b7-1f4d-4e29-a950-47abe57431c4", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817077, "uuid": "63dfc9b7-f28f-4f27-9e49-0805e6b93b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817077, "uuid": "52835577-78ed-4083-b6f0-0018ebd55f17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c22b08-a7bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675865748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865748, "uuid": "39ec48b0-dfdf-407d-b5c9-ad58b8113ee7", "comment": "Malware payload (GCleaner)", "value": "f251bca13fc8613c2fe839164e006278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865748, "uuid": "b57d7e73-2790-4a70-8f0c-27f88add5318", "comment": "Malware payload (GCleaner)", "value": "383e07c619fb8587ac5429d4c4b5d9c0d4424598240fce43af34625109cae9f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865748, "uuid": "2d3648c2-75fb-4e9e-bf7d-0f034ea6182f", "comment": "Malware payload (GCleaner)", "value": "bbf4a7608c9b57a75f81a644688580092c9825ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865748, "uuid": "9ad83557-30a5-4102-ba47-5e84f9ad0a6b", "comment": "Malware payload (GCleaner)", "value": "efdd7cd543aa5761ac20b06b91c62296c7958b831c5f63e4aa72d601d6b5480ca3519c2bcfd8d685567fed6f9d6e6e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865748, "uuid": "7bcc1435-8cc6-4fa1-9d0e-828968fd4a84", "value": "T152C5127C7105C46DD280FEB88D3AE8F71CD66DE3E8A4A422B1DC7F3E527A1449A1A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865748, "uuid": "fb8d8992-e002-4a25-846d-ecc7cb038d25", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865748, "uuid": "03e24b54-48a1-46ab-aacd-69577f3fce1a", "value": "49152:rdHaL8dIq/xlRqX832mYujGL5Ywn/KhHctKwuwDlfOi8JZG6eLCgv2MR:JHaQdIixmAYu0HihHctKZUll8T+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865748, "uuid": "33b51715-bee3-4954-9e1b-cc374ae8292d", "value": 2650844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865748, "uuid": "9e3cbdb3-9110-47be-a28a-121aa58cb37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865748, "uuid": "127bd7fd-0248-478d-9452-c0be88dff912", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441caa89-a79c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675852511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852511, "uuid": "1cde460c-43fd-49bf-aaf6-47e3dfeef221", "comment": "Malware payload", "value": "425d6b5bfce61f00cacf34a1796ab791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852511, "uuid": "d5644b58-99db-4f36-ace9-fb8aca982b9d", "comment": "Malware payload", "value": "3933f7126e46ab915e4fe1ca50b09924251e0e20acb1ff69c38ea442109d85e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852511, "uuid": "b61b4792-d1a2-49a3-be64-6190f649207c", "comment": "Malware payload", "value": "cd54be201447fd896e593ec379a49e7b7616ab29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852511, "uuid": "4c1792b6-c6ee-47cf-abcf-e8877fca74c6", "comment": "Malware payload", "value": "74e1e8efce6b2cdf4930dea43bbeb038ae56d3051fe71fbf387257c9332be21456bb5442035e0bad9d0f28ba6bd95132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852511, "uuid": "ec9a99f2-77ab-4e1d-9a69-c957293c808f", "value": "T1634449D6D614972ACC511BFE9B1367E2E4EE64774FDCA0C38608289CAC906FCB63055B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852511, "uuid": "011ad84a-2296-4a05-a31d-7e8e0e44e062", "value": "a5d0720f3a4011fe978085397c478750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852511, "uuid": "c8c4e670-1933-49d6-b337-31edb36790f2", "value": "6144:fk3ofQ4XpPXeZPjpHI+GQtZTGKcgMO0T+Ds2yv0+ZhmwQdAM8h:2ofQ4ZPeZPVHDGmMgMl+Dhi4wQGM8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852511, "uuid": "3ea8fffd-ef93-47a3-bd03-bb21ba58b792", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852511, "uuid": "701a19cf-2488-40a8-8d1a-fff4e429ee0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852511, "uuid": "3701c39c-2c6d-4c62-9353-116ac114a468", "value": "3933f7126e46ab915e4fe1ca50b09924251e0e20acb1ff69c38ea442109d85e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dee6f5-a790-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675847300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847300, "uuid": "68005ab7-a629-429a-8c12-3b6fd5d71336", "comment": "Malware payload (RemcosRAT)", "value": "9b3562cc4c78496d71a498fe8be8e2d8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847300, "uuid": "51f6913e-c14f-470c-b71d-c79c5ea846c7", "comment": "Malware payload (RemcosRAT)", "value": "3943babda7a93e6cc1991da15cdb36c87180f58ea34ba94b525ff321b5cf23fc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847300, "uuid": "b91abc2c-e9d2-4085-b96f-dc1ed662e985", "comment": "Malware payload (RemcosRAT)", "value": "9762102c7ace8378940af79428155efb15347e06", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847300, "uuid": "42d9b197-897d-4080-be23-b760b033da52", "comment": "Malware payload (RemcosRAT)", "value": "c6737edefcb16d3288d7ecb4b300e6f8b77a8f624d0485ef9608ff92871bc8276e834fb9e83aef37bddd3adfe84821fd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847300, "uuid": "fcb32829-f6c8-4412-a1e5-3cca3c8dd2fa", "value": "T12AA2E0473BC49E23CD9452B0E49882EFC162F095396A65DFB82392F695736C2302CED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847300, "uuid": "b7365773-3e01-47a5-9112-24437487f02b", "value": "384:jU1DhNFx/LtX21nW3nGcfJktWI0X3hO3LgPE7CbvI5XmxE7MmWmKvdLFwGbx43oj:jYh9/xGxkGcVI0XxO7GXGXh7amKvdNSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675847300, "uuid": "83abe13b-7489-4279-b66f-99f3b495fd2c", "value": 21635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675847300, "uuid": "a4000dd9-2d3c-4e60-a9a7-b2a8c15355d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847300, "uuid": "3a77f527-09e5-40bc-8305-fc38553c93b7", "value": "pre alert notice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622be841-a7c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675871889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871889, "uuid": "fa7aacb5-3326-4229-8216-b0880f29dc89", "comment": "Malware payload (Tofsee)", "value": "c8321c5b8e54d610f040f8433ff22ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871889, "uuid": "947d4f80-28ad-4771-aa24-ec1e9f358916", "comment": "Malware payload (Tofsee)", "value": "396f4dc820ecc31df7f6697af58d68b203fe68070ea530ec6e4d2c8af6aad4c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871889, "uuid": "5024a109-2f4c-4e23-87d3-f0a417d972f4", "comment": "Malware payload (Tofsee)", "value": "658a051f6e0dec196de1f78ca865c1ff688a090d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871889, "uuid": "4df53971-acac-41e2-952d-316e6df50244", "comment": "Malware payload (Tofsee)", "value": "ca97e14901c0f5b15b2b5e7a7e95eb3a911b6906ec460a1e380167250171430cc3d7589de8a8a153a7143c1dc0e26459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871889, "uuid": "39a04d3f-a74d-4ea5-aab6-00f48e9479d1", "value": "T1C964398397E1FC40E9618B73DE1ECEE8761DBA508F5E77769218AA2F14710B2C173621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871889, "uuid": "0b13fb67-77c5-4ae0-b20c-d92b77ac635c", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871889, "uuid": "71859748-d3b0-4b1c-ab44-55010854420b", "value": "3072:OPTfoWxKRNZXZkawIH+VVAcu3RLStKRxhUwbT75d:Orf9cIJ03gtKBbTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871889, "uuid": "f3d7dac7-f7c2-4fd0-b674-fd48bee46811", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871889, "uuid": "d8ab5698-1e21-4454-8b0c-0e72d19f97f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871889, "uuid": "cdbf9f12-1bb2-4f51-8f74-11b048704256", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f945ea5e-a7d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675878585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878585, "uuid": "916b307d-47d0-4149-9596-b199feea22b7", "comment": "Malware payload (CoinMiner)", "value": "25c8eda2967110723edaf9a50e778aa1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878585, "uuid": "9d010765-62b0-40a6-9f1d-02624e50a3ee", "comment": "Malware payload (CoinMiner)", "value": "39bd0c3dafa94753d58879996f6dcffe9fe70a9c9cf0be6108dbfb41064cd38a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878585, "uuid": "451eb6f3-72c4-4dda-89ee-fd27fed29f06", "comment": "Malware payload (CoinMiner)", "value": "bdf56958f1bac14783ac826ccc8c50eff984f23c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878585, "uuid": "265f8c23-817f-4f38-8c07-b015f309e4be", "comment": "Malware payload (CoinMiner)", "value": "818d66fd68763c7816b706a6ec37440bc97ac99f6b075a820a6b06a8b8eebfbaf049d6bcb400783bdc8b44b4a542a51b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878585, "uuid": "d8ecacb9-7bef-4f92-96bc-a818410f1da2", "value": "T12E641A03D2E27C85FA258B769E1FF7E8765DF5608E4AB7653218DE2B10F2172C163A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878585, "uuid": "0c31fac8-49c5-40e5-b84c-646597c10b8d", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878585, "uuid": "ef389784-f0b9-4cb3-96a1-b5707b5f78af", "value": "3072:YPgjl5zdxR99BRVmfNLvMt0DujXbYfQHUogQsWQDiuLpJt6uv:YYLrBMLUtukyQHkVLiqPFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675878585, "uuid": "726a4ed8-e25b-4b82-b259-5f42a3c8bc79", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675878585, "uuid": "01f1ab9d-b6c1-4e8c-88ca-3d84cb583c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878585, "uuid": "67bb1451-053f-484b-82a1-cbda12dd5679", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f8cb22-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675819869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819869, "uuid": "bd253495-edf5-40ef-8dea-61daedfc5283", "comment": "Malware payload (RedLineStealer)", "value": "09028f821999ca87b9c54d7ea5eff807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819869, "uuid": "7776b8a9-d3ce-4ded-b2be-4f9e7e7ffd16", "comment": "Malware payload (RedLineStealer)", "value": "39e90e4da4486f82c8ecd4b60671dfaf58c5ad7009aa5a0ed02823e399d1b692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819869, "uuid": "274237b2-14ed-46f3-b557-18a66fe6ba12", "comment": "Malware payload (RedLineStealer)", "value": "54f59bff88d0bce74932812df1e4907e3c350821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819869, "uuid": "e7337935-e5a8-42dc-809c-533a5d926baf", "comment": "Malware payload (RedLineStealer)", "value": "aeb7c360dd866f32a4816b68e3005c846643da8029dd8dd29ad0e9fa790d72309f9e3e9b07c96fca03a6746398937e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819869, "uuid": "87cb6bc5-652e-44a3-ab2f-c484058d1c30", "value": "T1E86402233AB0C072C1BE65701810D664AF3FA83156B9A9573B591B6D8F717C2B73A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819869, "uuid": "1bcf4d73-a916-4e8d-9aca-b697e6dbc1ac", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819869, "uuid": "3f71e958-8383-4512-a30d-ce046713cf29", "value": "6144:kfotY3sLL0ExMxgEhgeGPDZFGjSrR0FgeFHIdeDitP+7Lfcugjn:kfot+sX0E2hgeGnGu0DnDsP+vfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819869, "uuid": "2601d49a-9451-4ba9-8467-b29458d627b9", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819869, "uuid": "2357f4f9-ec00-4092-96e6-5c7f36b91be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819869, "uuid": "dcbc4df3-2927-41bc-b681-55b6e3307118", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b0de1d-a774-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675835275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835275, "uuid": "89807027-8acc-4ebf-aaa1-c740cbd33c98", "comment": "Malware payload (Amadey)", "value": "a44c5057af43aa1191564e075e52a874", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835275, "uuid": "9871a364-bdfe-4f81-ac51-84309039dce2", "comment": "Malware payload (Amadey)", "value": "3a3c7d95100b09f2d7963d553e35e8ae12184b65039463bfe729b9180eee618c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835275, "uuid": "3b038a44-e007-462c-b3b1-a4de64d37f3a", "comment": "Malware payload (Amadey)", "value": "07be8aa55245403d72d46144fc1d1024bebfbf4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675835275, "uuid": "33a70437-0b48-453e-b2c5-cf8c27873e9c", "comment": "Malware payload (Amadey)", "value": "bcdeeacfb9eb28b12de9016c819c7431e4fb7efbfb7d7d3988bf1e934fcf123ee787f81e929fb70956d891a9d31e9308", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835275, "uuid": "96873181-2be9-4a56-a4dd-9c20a0417fdd", "value": "T139C41207B2F89032E8B55B705DF203C30A7A7D6189B4938B764E7D4A1C726B4B53972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835275, "uuid": "edc673d7-a15b-4c69-b3c8-0045c48e4b8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835275, "uuid": "f0d3054c-c72b-4657-a91a-795fd392c812", "value": "12288:PMrmy90sJtXU2lETCrAJBvALMyaxURgC:ZytJQJALtaa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675835275, "uuid": "5de9c3b3-cc77-4162-8cc4-9837a81131ad", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675835275, "uuid": "710c446d-102e-4a39-a23c-b9c11cfbecdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675835275, "uuid": "6c6497a6-be26-4d43-be4d-7e38526f52ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec8148-a790-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675847479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847479, "uuid": "d17c58ce-b63e-4bc6-87a8-403c00b7976b", "comment": "Malware payload (Amadey)", "value": "ce7491f38e7668026ee364ca25d322f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847479, "uuid": "17909eb6-a753-4d83-a7ff-b42f8663d975", "comment": "Malware payload (Amadey)", "value": "3b0999d936fce63623696590b04396f3511af7ba6222d5239c52e1beec6188b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847479, "uuid": "f06f07c6-c553-44b5-a684-d445b9ea71f3", "comment": "Malware payload (Amadey)", "value": "5390d4bda0be14a310d3f479d122fd47d9fa63db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847479, "uuid": "ddb56892-1ab9-4bb2-9d67-5881eaea2a2f", "comment": "Malware payload (Amadey)", "value": "2c6314d1c72457ae35dcf9bcf129216f60386fbb8491e1d9feefd9d91a5d94adf8884f5750403638b2d973f3f2d14b99", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847479, "uuid": "83a8a4f6-b772-4b20-8d83-a350c7a7de4e", "value": "T1EAC4021BF6E89033E8B1177419FB03C30A357EA01B388356275BAD592D727A0A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847479, "uuid": "6de39284-5c4e-4389-b2f5-eecea79877a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847479, "uuid": "21d951bd-8203-4f3b-8756-612b8cc77d54", "value": "12288:7MrWy90WirvVt6UGxFgMDe4uzOk6qtDBMnq6MeAFKzJh:RyW7V8U2FgM7SDNZVZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675847479, "uuid": "e09203b0-6319-4f54-9667-77f0d195c027", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675847479, "uuid": "d1198bbd-3847-4ab5-9daf-bc01197af4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847479, "uuid": "012c04dc-71b4-4fb7-8f9f-a923a6050eed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb44857-a7c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675868362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868362, "uuid": "26b164fc-148f-462c-b4d5-bc416ffa1525", "comment": "Malware payload (Amadey)", "value": "e554533fb226f359feef9611867130af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868362, "uuid": "de5e7039-ac5d-4c87-ae72-814fa7e9a453", "comment": "Malware payload (Amadey)", "value": "3b0a610e4cafe38022a2e9f42b0a4b2d098e167be153749f1e6ae2d48a44cbb6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868362, "uuid": "7e7076da-00e9-469f-98b2-e3aa0d1f3288", "comment": "Malware payload (Amadey)", "value": "e5017fe92f6067f6610115cd48b770b346036afe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868362, "uuid": "47fde389-457f-46f9-909f-eaba64e3f931", "comment": "Malware payload (Amadey)", "value": "fbc2734c925f802dcf76af6be0c7f22feecfb76995f0797381dcaafaa26599292f306e08acf94397e63f48ce68bf7576", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868362, "uuid": "f11f80a1-600e-4cbf-a3f6-a42962f33d06", "value": "T120C41247E7EC4432FCB467B019F702C31A367DB067399297624AA94A0CB27B4B671367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868362, "uuid": "8a490647-21d7-41fd-882e-676c4927379d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868362, "uuid": "2d4248e8-1fbc-4fe0-857e-2c101b41cca0", "value": "12288:UMrvy90uhLhm5O2AJLgj1eN8LHG6qoHkp8rWqKiF:7y5k5OhJLGeNcqoHk2rVK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868362, "uuid": "e72059e9-e0d0-4f91-baa3-ef242b69f5bc", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868362, "uuid": "d4d53f76-6072-44ab-9871-94c37f204cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868362, "uuid": "9043246c-f365-4ea2-8090-2e2f24356aa1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17787874-a7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855443, "uuid": "b5decce6-43aa-4fbd-949e-6b17512dc308", "comment": "Malware payload (AgentTesla)", "value": "32e51fa62a4a42996e34d4a44b0bcd8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855443, "uuid": "3e04bcb3-bd8d-4f97-b5eb-d59d1ae2f3e2", "comment": "Malware payload (AgentTesla)", "value": "3b81d0340e7eb9ad652fbaec10a8392027156a5fb7eb2c6bb3f4d8b851602f99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855443, "uuid": "ed48cffd-4c27-4070-bf89-87551f264e7b", "comment": "Malware payload (AgentTesla)", "value": "c971fdbec3f95a2418efc0852aab0616228ee7dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855443, "uuid": "c42275eb-3b3c-4775-b9f9-874bf23748dc", "comment": "Malware payload (AgentTesla)", "value": "ea6fb2a71f76464bd7cfac08032cfc29d210df32ba63c46c3f4452cc6261f51b467e47adb7abe43e1c9a424407e6c5d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855443, "uuid": "4b295013-6585-4d9a-abdb-4ec11fbb048a", "value": "T1408423E236759CBC4E74127A0E3BFB0296838AB71B705FA41CD19647D46B16C0CD6B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855443, "uuid": "d1488448-285b-4a57-9bbc-e8bd17d72247", "value": "6144:y8+ESilBrVaDwIER95R5lz1Ujyvu072yKIYbo332PstVR2F0bVyF:xQYVapE1zn46332UtVwuoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855443, "uuid": "c0a82263-2d90-47fb-9e30-3e3e1b59c315", "value": 390769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855443, "uuid": "9637063b-609d-4664-840a-5fc8a2838f6e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855443, "uuid": "07e0413b-0181-4328-85e9-d1c09efcb150", "value": "Urgent Price request P.O 1672891FTN.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76a9027-a79d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1675853242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853242, "uuid": "b4345d62-9a4f-4b8a-b59f-9446501186f8", "comment": "Malware payload (Gh0stRAT)", "value": "003f93a1f33ec617b46a87c98b19fd85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853242, "uuid": "036ae498-11de-4699-bdce-f360f7edd427", "comment": "Malware payload (Gh0stRAT)", "value": "3c096962f3f447b1a0d136c730f0d979faafb01f22eddedccfc801bc167e0925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853242, "uuid": "2140ce8d-37c3-4bf4-82f6-2950048e6cb0", "comment": "Malware payload (Gh0stRAT)", "value": "cebe846ccb643f8f843206d52cd701b02c1708f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853242, "uuid": "8ac6bc7e-bf88-4021-afd4-f3b47f8ee98f", "comment": "Malware payload (Gh0stRAT)", "value": "1108401969bf9538241a7eb1f3ffa107a500d830d39d6149ddcb8282d498c363d79d6a76fe6abe21ffc6bc3f351ae04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853242, "uuid": "af4eefe9-f0de-4330-91f2-dba052abb5d5", "value": "T15744011BDBC50A3DE06F87330C0A6972BE62F64D20754F3503989958FD1AA2334EE2B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853242, "uuid": "2d6e882f-1632-44df-941e-ac061a255260", "value": "e0ce5ef0bca7a89405f5a38e31b7697b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853242, "uuid": "ecfac5b3-501e-4d39-b22f-775dd9ecde4f", "value": "6144:OK+/nlJyamKOrllFIFkRqqfc+MYCvNxrQWSFS:Ejy3PLIF3qU+lOxrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853242, "uuid": "90f5d7c1-6f4f-4981-b34d-f1edf3c25ffe", "value": 272037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853242, "uuid": "3e1a396b-b5e4-48f2-9c47-5106e8d5241d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853242, "uuid": "efdcb1f8-4314-462b-bb3b-ed08fb1d623d", "value": "3c096962f3f447b1a0d136c730f0d979faafb01f22eddedccfc801bc167e0925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab5bcae-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675858992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858992, "uuid": "78a8931d-0a9e-416b-bc20-bbefd463a2d6", "comment": "Malware payload (Mirai)", "value": "abe9f5a20f44fe1024ccafc769aaf78e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858992, "uuid": "4fc33496-1792-4241-9891-0613b3d24029", "comment": "Malware payload (Mirai)", "value": "3c83d7775db4c48181ccd26db85f2d69ea45dc5b98ddc246bb4ef66cad38a623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858992, "uuid": "c1ade27a-462f-493d-a8b1-08e9ca95b27f", "comment": "Malware payload (Mirai)", "value": "b6e02f405c27f2b35d29e23f9a5ff03a97d913db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858992, "uuid": "0bdc4062-dcc9-41ba-83ca-638b423e07c5", "comment": "Malware payload (Mirai)", "value": "ce521d6a3894ee15d168c91f11e2632baa19214af7d22c9d036a6b9ab8d0fef02c71a5bdef87e711e2ec787aec1e7da7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858992, "uuid": "5679a02e-209c-4c4d-830d-ecd59ec3f2e1", "value": "T10233029A61E6EC91CB37403261B14184619E7730E3ACA6F75F593B1CA850EC462FF6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858992, "uuid": "785267dc-f2dd-4a47-99c3-3fa0bcb7ee78", "value": "768:oPhXhSKJ+aMHm9RK9LxjCXxq+DzyC7X9Af+gW+Xb09q3UELPzYC8pafON5ZgKBdY:oPhTM5njCtdX9rEXbdL0C8pGy5q+fl3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858992, "uuid": "4e153d1b-953b-436e-921b-6cbdfdc37f1a", "value": 53644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858992, "uuid": "ddf5ff98-efe0-4dbe-b3be-b3dff47e96c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858992, "uuid": "1e86b820-0626-4f6b-aff9-29cceda028bc", "value": "abe9f5a20f44fe1024ccafc769aaf78e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b080fde2-a7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675859995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859995, "uuid": "47e065dd-2864-4db0-a82c-4a7ab1970a12", "comment": "Malware payload (Mirai)", "value": "825df97189910eed79f602ebec6887f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859995, "uuid": "50e0e120-38f6-4469-967d-6fb6ed4ad6d6", "comment": "Malware payload (Mirai)", "value": "3c9c3ab6ccfb8c58e5cf47e68a03a802c3b4a02addcdfbe995d421ddfd515a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859995, "uuid": "58ba4eb0-b307-4fb3-80f3-0044c50f2a4a", "comment": "Malware payload (Mirai)", "value": "f8e9f78619a3254534139d5420853e9b814e4781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859995, "uuid": "869f66a2-be55-4213-adf9-46b44e16d638", "comment": "Malware payload (Mirai)", "value": "1c02b61034cb378d65da66d57868283db52ed2f290261fd843e24256db6df3449c2019456193d63403e63a224e54fe9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859995, "uuid": "8aa1cfb8-647e-4aaa-ab0a-3fd44425f9f8", "value": "T1EF734B24A9792E26C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859995, "uuid": "ed1a3431-7ff5-4987-89ff-c42e2660a1d1", "value": "1536:SbHmkTSo3BOIqS5aq+Dc030R9QuEk6vNNTjjfAFRo:omcjaq+Dcc0J+vN1jfYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859995, "uuid": "5846b2a7-0356-4a61-a684-ddfc1d218022", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859995, "uuid": "b8632a31-d763-45f9-afdb-70143266e9c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859995, "uuid": "30d5b172-79cd-4795-a5ca-6128eb8b09ea", "value": "825df97189910eed79f602ebec6887f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f4b979-a80a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675900006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900006, "uuid": "7afbca88-5f24-4141-91a7-2c3704e1f83b", "comment": "Malware payload", "value": "358ffac1e5efd1f546159967f61deb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900006, "uuid": "0aa33e5d-04ec-4d70-b2d5-6b66f14d79ff", "comment": "Malware payload", "value": "3d10b461229396493d0c7e2877360f66e41e11dbc201a11e382ac3f19c10d4fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900006, "uuid": "23395946-b93a-4375-9517-53024b513d98", "comment": "Malware payload", "value": "7033914e678325a53734bdab61b0dec0cd1db798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900006, "uuid": "65a1d360-f8fa-4026-8ede-4a7999b34274", "comment": "Malware payload", "value": "2f511333b91888c6073f8e0329ca9e975a0a6de4489329da977a1ef4fbb02dcf4585d067d53a8b2d8cd263a4fc5db078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900006, "uuid": "f64087ec-d0f7-463a-8a0b-499cc3d08eee", "value": "T1F5640A0393917C84F92A8AF2DE1EE6E8B65DF5508F4AB77512189B1F34B3172C663E10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900006, "uuid": "8242be36-8ad8-498e-8824-853786ad425c", "value": "48d903c5751da17f2c5d5f89e77b3bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900006, "uuid": "a6afa5ac-0fa7-4112-b5b2-0e8251b9bf2b", "value": "3072:DPEWnDGSPRdjjW7+QdoFn4L0BoeaqC98RqgCQENe+pGSMjK7MfQt7fz3:DMWyEjjWddoFcOoeRC9LJQkeQGS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900006, "uuid": "423bf718-f577-4c2c-9903-4fd3a13f07db", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900006, "uuid": "9304ae2b-f051-495a-8203-689ea703c80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900006, "uuid": "d62632c9-1f0d-4d75-92e7-ab1526b8eb8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437e5b67-a7e6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675884293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884293, "uuid": "140df534-518f-43d2-b169-18c4210d5c46", "comment": "Malware payload", "value": "2c5c7bdaee933098ea04a2968151599f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884293, "uuid": "08271526-b6a7-4602-a18d-db82e94ba0f1", "comment": "Malware payload", "value": "3d23094edebd245cd59f30a1e54865e3862cd27a50dcf2c9404b1365fa7bf052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884293, "uuid": "55eb7864-41b9-4af5-b9ad-bdb3d32cf548", "comment": "Malware payload", "value": "68153d3d79a0bb3dd602384c508947d59c9470a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884293, "uuid": "66d2c5d3-576a-44e7-8723-60221358a083", "comment": "Malware payload", "value": "e5f8f565332d4c3dadd2b3b6ccbfaff104f4a478a3687169c0fccce1efb851ab36fa3539b1b4f32e3b04dedd286fbf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884293, "uuid": "2fa8d63e-828c-41dc-ba78-42cd2d867afe", "value": "T16DC40213F7E89062F8B52B7018F602930537BD105B7883AB678F6D6D15636B0B23676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884293, "uuid": "88bd2b46-7a83-4503-b3ff-a4fa57e7e5fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884293, "uuid": "08fc86f6-9773-4ce7-b1c4-7cf7719987b4", "value": "12288:NMr+y90MXI/4q40M7GDYuBNLTe7DwdYgj/Xoq1bs+isd9Rgt:HyFi4q40M7GDYuTLT6tGoqBszsfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675884293, "uuid": "09394f01-cc7a-4dd9-bc71-49ca3c20dec1", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675884293, "uuid": "37c06c45-a5ec-4831-a225-345578b9a73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884293, "uuid": "5a7c464d-abba-4c6a-b440-96216fe32121", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ce82ed-a7a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855175, "uuid": "855b7959-7827-4675-b680-4d36a26deb94", "comment": "Malware payload (AgentTesla)", "value": "de5d608f83f270caa4c78e3bd7f53dfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855175, "uuid": "989be02f-f183-442c-a687-dbf04657817b", "comment": "Malware payload (AgentTesla)", "value": "3d575dba507a9b9b606ef6c36f3ab826a8de8593a5bf2f5da2c1a10516d01728", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855175, "uuid": "c936c25f-7bc5-43dd-aed1-d8ab4d3bc5cf", "comment": "Malware payload (AgentTesla)", "value": "a278e893a5782fddcab6d8db0bf0f7402ac1edc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855175, "uuid": "c869f392-bc95-4fec-a4c7-48c8a1a9766d", "comment": "Malware payload (AgentTesla)", "value": "b40206ca9e482c59db9459e9cd22e1ecba22337d917ba224579b875f733a7700954ac1da0943fbb77159b0b85e6db395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855175, "uuid": "eaa38bec-724e-4ff3-89a3-52c67e973db3", "value": "T150F4CFBC7794BC8EC4278FBB85042C00A660F4771B47F383A45B15A99A1EBDD8E546E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855175, "uuid": "9ef76679-61fc-4ab9-b9dc-486fa1b84092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855175, "uuid": "7cf1db08-be8a-4cf3-b69f-57a266ddeba2", "value": "12288:474c72ZByyIMLn83huSx4/LZfp7VaMsdhxUWVGsFtMdoYbrv6z6iqTS:3Z0yB834SyVaMIXBU3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855175, "uuid": "bc3685f6-c2cb-45a0-9899-df4084b530da", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855175, "uuid": "b0740d53-346d-4571-844c-17ea9a1d49bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855175, "uuid": "a89417ad-38fb-43c7-965d-ba5de5af3a4d", "value": "3d575dba507a9b9b606ef6c36f3ab826a8de8593a5bf2f5da2c1a10516d01728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641c0040-a7f9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675892508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892508, "uuid": "f9d99574-8df6-4e4d-bc80-1b95fd1bc681", "comment": "Malware payload", "value": "480a524f0b5128829089c0a4f480a179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892508, "uuid": "95f540dc-5297-4784-8a29-4b435a0d058f", "comment": "Malware payload", "value": "3da5516f3f65b9c3ecbef09fc5f8d1498a4f3fcf736251899699ad3a05dc72f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892508, "uuid": "5900cc63-af4e-4b99-b994-e2b55e2c4078", "comment": "Malware payload", "value": "01985de74c6e18c240b57a4f017e234401535b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892508, "uuid": "5e7c7fbb-933b-4b87-9da0-2005d2334dfa", "comment": "Malware payload", "value": "57c96b8a1dd2e6f7debcb37ecceadfc592c33553494cd0cee86287c9be194ee8a8e02e284f3781624f98a59ac2a24c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892508, "uuid": "82ea8032-c909-4fbc-becf-354e13729f1d", "value": "T1B8641903D2E27C80F9658B769E1FFBE8765DF5608E4AB7753218DA2F14B0076C263624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892508, "uuid": "acfd8329-9159-48d7-811f-70f7052d5b11", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892508, "uuid": "5a3552fd-92f7-4d15-ba70-ed33d06f5471", "value": "3072:lPgdvaHkU5RF+hXomhidSAaKirgbSGUJLonAtfY4gsWQDiuLpSIgv:levxCyXoGV1gbyJ0nAtQqLiquv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892508, "uuid": "1927eac7-bcd5-4a5f-92cd-2ac9573f67fe", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892508, "uuid": "56425aae-2d10-4036-81c4-39796c65cc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892508, "uuid": "39c30f31-d933-4a32-8a04-46b1982db216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc61efe7-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868282, "uuid": "948c6676-1ef4-48c1-96e5-32bfe425cc76", "comment": "Malware payload (AgentTesla)", "value": "1fa1066f6b9b52238815ae9006d463f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868282, "uuid": "836655a1-8b72-4b0e-9ac2-f3f573bb16d1", "comment": "Malware payload (AgentTesla)", "value": "3e19cfadf0f3d6ba2d1c3996ec4eb73713af02b882101d88a039177987b73d8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868282, "uuid": "ce83fa09-0a14-433f-837b-04c7767f4204", "comment": "Malware payload (AgentTesla)", "value": "60f8ee69c9446d1a444209af1aa878290680a61a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868282, "uuid": "3cc9d721-8502-49dd-b626-7fde626f7bdf", "comment": "Malware payload (AgentTesla)", "value": "59631af580549f25f0e36f7cf8c22f06426dfa7aea3bc5e21274dd5f07788576ce983142f67f66319b57466375aecc55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868282, "uuid": "1a015538-c833-4b69-aa3c-be7de3e2523f", "value": "T1FD05062D1C7622E2E1B8FB7196E28420B59C5C92730FC92AD8DAFBD17F011426E8F55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868282, "uuid": "dce7fcef-4cad-4059-89e8-436d24aa11fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868282, "uuid": "e561dfac-c597-43bc-b2e6-3694f59a3cc6", "value": "24576:Db8vOztLHKNu+A+/1bpI8Dybkz2lk6LrAOkQmoS6:UIbc6fAOkQmoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868282, "uuid": "e0f4557f-5baa-4280-90f3-b543aafa9904", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868282, "uuid": "3799b7ba-46d1-4a43-b70d-d0e388195cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868282, "uuid": "607cc819-bebf-4bd5-85cc-fcca513fda06", "value": "PO#88224, 88224-ADD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4883954b-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675882154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882154, "uuid": "bc1f3a10-f139-4216-8ee9-429aebd991fd", "comment": "Malware payload", "value": "55273ebef2463c28a4ff6a4cf35b7006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882154, "uuid": "77c0ffb4-0b72-4113-87e0-f731dd4fc725", "comment": "Malware payload", "value": "3e4181c955fde06d7b11ab0b9460be884bf8e0dc99d55e667a08ac22aa825c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882154, "uuid": "e31b055f-9521-4ac8-86bd-152b1dc9042e", "comment": "Malware payload", "value": "3f0426b77bea5cee24abc8501ed46b9a2cacd08d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882154, "uuid": "f8a7ff18-53b0-4ce0-9d5c-1adcfb459ee1", "comment": "Malware payload", "value": "d0409abf30abd8cb54db072b6b3a9c58b4703570fe7e6880c8244627254f1acb701dc660ed421d2ee8eed4fc9b868346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882154, "uuid": "0293e0d3-c09f-4123-b463-24eb318d9cb6", "value": "T1FBF4B2B094BB469AD00FCC901ABCFDB415B672F3D8D60EE6435D77086E2AF947E4214A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882154, "uuid": "ce50378f-a187-4615-a6e9-beb0c1060ed3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882154, "uuid": "fad7498f-cd80-4a4a-8ac2-82a0ead48c82", "value": "6144:NzvIplX+ONyy2Ca49rxvifqeaKku/hRJOl8lU/XvY2xCkPDZz4Dfy2t6Llwj6n5/:Mg+5EtHUB7lceAv5Dlbs6ZSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882154, "uuid": "eaec5533-0391-4d2f-9fb8-c1ad16d4c1be", "value": 724636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882154, "uuid": "20fce273-d071-4d81-87c0-4b2f7ccd1b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882154, "uuid": "ba827841-ce90-4063-8c18-437c14cbd344", "value": "55273ebef2463c28a4ff6a4cf35b7006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38999f71-a787-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675843473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843473, "uuid": "7780da2b-d32a-4cc9-8231-f8abf0ca5316", "comment": "Malware payload", "value": "962ed92736c8a44686c80da6596db83d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843473, "uuid": "b909a50b-53e1-49f4-8e4c-849a458f96ff", "comment": "Malware payload", "value": "3e49e1d536eaeffd4e4c87e511b660a28d212de4d712776fda5fd5f82bb3f257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843473, "uuid": "af0faf20-675c-4e73-a2fb-d9a3144e93af", "comment": "Malware payload", "value": "d6563904cf4bcded4d3e79d1af96a4e572bd9de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843473, "uuid": "1b476597-8bc3-4812-bb85-7c0c7b1b40ad", "comment": "Malware payload", "value": "14b7da20dbb64f9e48622ef4e12c648616368027779a55c91f3eb97205f7aa8eb9711ce6aee5e55ab27eb15a4ebb2b2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843473, "uuid": "2fcdf729-0996-4312-9320-7e69dfce53d7", "value": "T1E476332335F954BCC98219728D14ADDA80DDB5E183370D7B53D8816E9E3DA87827AB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843473, "uuid": "5f7299d8-c3e5-4993-8870-0f0196347d99", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843473, "uuid": "87a164fb-72bd-4647-9f92-cc4981889311", "value": "196608:91O/Q3n/8JkrwQYt8d/5GVFr5P8X8HiZLZB1S7fXUZ+af/+U0E6010:3O/yn/8Jkr9Ytk/kdP8M8Uz8+S/+UZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843473, "uuid": "6fb10705-51bc-431f-b632-b24d730d5c3c", "value": 7652977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843473, "uuid": "088d6717-6720-4ba4-ab31-15b81ad0970c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843473, "uuid": "8a7f6fe3-f58d-4dd3-93dd-1dcaf038cae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c218c9-a746-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675815552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815552, "uuid": "fe23ff1d-a86c-4bba-a83f-9acbd6ee300b", "comment": "Malware payload (Amadey)", "value": "baa98a50374b4b3f488a14a37c554e2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815552, "uuid": "f7ebead5-daff-404f-88f1-332bc9cbc267", "comment": "Malware payload (Amadey)", "value": "3f31a80397d65f16cfc5deafcded840964e87b41e27b198901c1b9c60ab2fb08", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815552, "uuid": "ee0a1637-f491-4a0d-9e06-649fc67a4300", "comment": "Malware payload (Amadey)", "value": "eb57422a7dda22d7097f28df621f254d2b5c7b90", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815552, "uuid": "834e1a2e-25f0-4b0a-a7cb-e55b6b92f4a4", "comment": "Malware payload (Amadey)", "value": "6ff5764939e8dd1575a32d56baab152238ff795c7fadeee2ef3947b407c9dfba7c294090ccffa100f4c522a7fc4a98ff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815552, "uuid": "b2e5d73f-daf1-4c8f-8c42-14059402e9cf", "value": "T157B40207E6EC9033E8F9477019F607C31A39BDA25B39864B234EAD1618725B5B632377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815552, "uuid": "8a982ff0-6a41-4b1c-9a1c-4f70f0c3fbdb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815552, "uuid": "c19cf81f-664f-44ff-84e3-96ef84d26d48", "value": "12288:iMrGy90G7uV2C9x4lkTOsPHkPRU2QJdd6cXWtdo1lO8VzaAIYUUl:gySV2A4SLPHkPG79PXWtUwyzI6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815552, "uuid": "52b6e910-52f8-4bc7-8d10-a7f947434c4f", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815552, "uuid": "c772b9be-f266-4a42-b190-2e14fbdc2a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815552, "uuid": "f5c01afd-53e9-4e3c-864d-fa4ef037fbbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4bbc11-a7a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675857947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857947, "uuid": "59694cd5-780a-4f41-a356-a7b1327401cb", "comment": "Malware payload (Amadey)", "value": "fd72722bded77659c134b53bbee369d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857947, "uuid": "9e65da62-8591-4e7c-9822-d35e8e0ef4ec", "comment": "Malware payload (Amadey)", "value": "3f740db1d27d48cc27e0722689e4ef73d8940ef317553bb98fe60d32670bea7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857947, "uuid": "798a7719-5cb9-4be7-87ca-cf95ede651c1", "comment": "Malware payload (Amadey)", "value": "8df369320969e0cbf6e94825f310eb74fbbecd09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857947, "uuid": "d522e74b-b847-4306-93c0-051a5cbdc73c", "comment": "Malware payload (Amadey)", "value": "e9a96acadb1b18b19507284775f2b10e1df7bfd54bff92e3afee6de253874fe7dfa2df7e6b6e2f46f60c8e98d9d13a4f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857947, "uuid": "0fe9a77e-598e-40f6-9941-81aa3b03b6dc", "value": "T148C4020BEBE88173E9B05BB058F213D70A367E515B3893A7A34F5C5A18B2574A630377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857947, "uuid": "9a3fa5f0-d195-4a7d-b3be-29793eb77c3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857947, "uuid": "043fe9e4-fb73-4d96-ac63-1d682306e7c2", "value": "12288:qMrry90T3Xj92y/Mqcdhq4YuCPxZlgbJd8grx9+OA:JycD92fqZ4Yf/gtRtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857947, "uuid": "e7d5a7ed-34c9-4239-8d59-3ecfcf6bacdb", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857947, "uuid": "8e8c4a05-4d86-4dc5-8e4e-22fbfdaf5ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857947, "uuid": "ca59a27f-a110-4170-b35c-0b63bf3558d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467ded5-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885368, "uuid": "cead6832-2701-46f2-b12c-a9ec57faebd1", "comment": "Malware payload (Mirai)", "value": "4b1644349c2bceb63b80f0759ad94c09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885368, "uuid": "a52cf817-baeb-41dc-9106-2c082a91be1c", "comment": "Malware payload (Mirai)", "value": "3fd6182520c4c28595511d995493fd71bfaff5fdd65b766dec9937aab9c775aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885368, "uuid": "856e2130-3f1b-442a-b022-e42137c46d68", "comment": "Malware payload (Mirai)", "value": "8274310813ebfaaa7b4b121ccd36547aa724938b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885368, "uuid": "02845746-8d64-4af5-9352-df33b9c7fcb8", "comment": "Malware payload (Mirai)", "value": "246397d158403dd6d10c549b86bf0deee0cb0b2585a400fae23e2d036cf152e5dfa019e6bfa358d3703573418f9eec67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885368, "uuid": "cacc4e32-0b7a-4197-9617-1b0f68cf45c5", "value": "T1F86382197F650FF7ECAFCD374AE9174620CD641A21A87B397A34D818B20B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885368, "uuid": "5adc2b38-46c9-45bb-8396-eed3b5b3bcff", "value": "1536:T7tJSi5Z9q8NPx+WJUEvggdsWWjoJaLZLdqs:TpJSi5Z9dx+xoJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885368, "uuid": "fa89cce9-10f1-4621-af59-2f783c648755", "value": 69132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885368, "uuid": "1bc5a8cd-1599-49e8-b920-7f21b57a3e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885368, "uuid": "a5302bf9-0d0b-4d22-8d7c-36ec7688a8d9", "value": "4b1644349c2bceb63b80f0759ad94c09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa340538-a7cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675873862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873862, "uuid": "f4f9b431-dc59-4835-94d5-bea7894ab377", "comment": "Malware payload (Smoke Loader)", "value": "c9106bf9d411abfdc7780f9bcc28124f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873862, "uuid": "57f9eee7-20cc-4076-a51c-e59987a3c775", "comment": "Malware payload (Smoke Loader)", "value": "3fdf2523cffcaee2bd306349f074c99baa7165ab615fd15339562d740f3fd616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873862, "uuid": "157f4762-db83-4b5a-9fd6-dae6966f1e4e", "comment": "Malware payload (Smoke Loader)", "value": "9f426c606b6c378ed6cfd0728c49b97fb921a611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873862, "uuid": "4882e698-bf02-4852-93f4-ba292757819c", "comment": "Malware payload (Smoke Loader)", "value": "b551174ab358be0fcf3d8744bee6260578f8c8ea4f6c555559fb06f52ee69a503b043576829127eb1b3efb33857973d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873862, "uuid": "27045a57-ae8f-4bb4-97fa-93ab642394ec", "value": "T15D640803D2E27C84F9268B769E1FFBE8765DF5608E5AF7652218DA2F10F0172C163690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873862, "uuid": "b7a4bf8f-5f04-4014-a101-19e1364288be", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873862, "uuid": "d73b47c4-e398-4021-83eb-4c0fc95fa7f1", "value": "3072:UPg/3+S6zxR9J3Z42YHGgzBTY4Mk0KNYYafn3YDLAAtKvsWQDiuLph6d9vJ:UMm5Jp4Pza4vYYu3YDDfLiqhW9vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675873862, "uuid": "56a93d0a-9729-41b9-8f6c-68f3a2cc350c", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675873862, "uuid": "28373932-88a3-4525-a58b-58deaafee0a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873862, "uuid": "5f2cde6d-8acd-47e9-933d-2f750e62ce1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65637c08-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675868029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868029, "uuid": "f2737c6d-4112-4920-828e-3d559e229dfe", "comment": "Malware payload (CoinMiner)", "value": "632e30b406ba48ff19f20db0aa9a1feb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868029, "uuid": "6f1cf42e-79fa-4e54-981b-60d5259f2f60", "comment": "Malware payload (CoinMiner)", "value": "4027b787a3d9f996752b1dac23a6965d8ac59d46212d1a0a22251665753b73ee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868029, "uuid": "4fee3954-bb15-49ed-b746-bf98610ea858", "comment": "Malware payload (CoinMiner)", "value": "74462f523644c1742dea3b353b127f94d7b17b18", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868029, "uuid": "e763bb4d-af62-473c-9c89-fbfcd46be05d", "comment": "Malware payload (CoinMiner)", "value": "eb7abd468b9e616ef06fe7c290c16cdc344415319da6b64aa7ec5deebdb0d2f181e7a623fce79038defc5d4d4005296b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868029, "uuid": "97bc6423-005e-40f9-8936-4f667f024fa6", "value": "T1F9642A8397E1FC40E9658B73DE1ECAE8721EF6408F5E777A9219AE2F14710B2C163611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868029, "uuid": "7bbe890e-8b1c-403d-afcc-2926b1caa70b", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868029, "uuid": "78417740-f253-43e1-9aeb-87fe12cd5651", "value": "3072:1PqNf7fxKRNTUftUc9TZeG72JC3F8B1/BACH6MM75RLStKRxhUwu:1yNzfcetUcKBTb5AaI5gtKBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868029, "uuid": "56182775-f72c-410a-ad7c-3f3a722ab0db", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868029, "uuid": "1cedae2e-f4a0-43c9-b63a-c9ed5a0f0581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868029, "uuid": "da8830d6-0b09-4a19-8201-c97e4fb3f0ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99363a0d-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675885296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885296, "uuid": "d34c589e-f59c-4039-9059-7c9d9e0e90b2", "comment": "Malware payload (SnakeKeylogger)", "value": "fbd93ef7f7c0d319e22b59cc56ca9a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885296, "uuid": "8d8dd736-4f01-4acf-85c6-56609f699495", "comment": "Malware payload (SnakeKeylogger)", "value": "40c0aeecd4e2a74e596321dc0ad63cd62ce9e3c0cc1a2d095844e20bef5fec40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885296, "uuid": "83e1744f-b495-4bf0-9007-b0dcd8814482", "comment": "Malware payload (SnakeKeylogger)", "value": "4ea9232d596a9cecc89e50c73a43bf45b99ffa32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885296, "uuid": "3ce417d9-f204-4bea-9472-7d38c6d6f4e0", "comment": "Malware payload (SnakeKeylogger)", "value": "1fa464bcbded6f1966fd67c1e97760ed4ebc4d0722a45a114a27f6fd450290632880f5e729d689650c2022e3024e5606", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885296, "uuid": "d81edf16-3684-4c00-8d38-ab6fdf3d01a8", "value": "T1FB1512256214CA64D46D47BDCCB0EAF113753EB6E960DEC72DC2BECE3A367A14054AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885296, "uuid": "1d77c6e3-f7b5-4d4e-ac6d-556bf4bdb901", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885296, "uuid": "b2ccd534-ef05-48e5-8509-15902389b078", "value": "24576:71bgzPGhgzfYAwMYeJ73JUSf81R1gpHZo:7ZyPyywAwMYe86CRmjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885296, "uuid": "9da221a8-9c96-4c90-8b1b-2bc6d942f31e", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885296, "uuid": "643d078e-69db-497c-8938-4aa19e1b684d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885296, "uuid": "860d108e-33ed-4987-8f2e-982ae0fff081", "value": "fbd93ef7f7c0d319e22b59cc56ca9a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72fd4fe-a7a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675857053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857053, "uuid": "90fba465-d29f-4f5f-9b7d-0546d82315fe", "comment": "Malware payload (Amadey)", "value": "70caaef1f74949c0d4809d30106c5dd6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857053, "uuid": "33110076-c9f9-403e-9a4a-2ac1d2f23fda", "comment": "Malware payload (Amadey)", "value": "40c3152ba617b4013e7bc831b99ef88719004e1be5767abdfdf81eba682e2bba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857053, "uuid": "b316cfd9-5d69-48fb-9500-cca795c4fcea", "comment": "Malware payload (Amadey)", "value": "24bbacd1f9e8708c986ff3b17d2b4449128c2a33", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857053, "uuid": "40630fb4-f6d8-47b5-88b0-f3766b10a25d", "comment": "Malware payload (Amadey)", "value": "7836a7852011f254ce761eed5b6f8a30568cb2cfb58605b2d7fc910eed07029119cff90b3b6a9117aeeb6ce951b3d46f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857053, "uuid": "3c970d25-942d-4545-9df0-6252b9fa7113", "value": "T1A0C4121BF7FC8072E8B153714AF603D3193A7EA05A7C82DB274A695A04712E0B63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857053, "uuid": "cffb4c8c-1b82-40e4-9855-5ab490bf5f54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857053, "uuid": "693b33d8-bf00-45b4-821d-8812f896de19", "value": "12288:/MrKy90ynSfsvf3AhHYgAhtLdlhI2rYxSqbc3i:BynnSg3A78th7I2c0icy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857053, "uuid": "0c68d1d7-635c-46f9-a18b-d03245d6f939", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857053, "uuid": "f4df3314-646a-4370-a51b-78cfdec9890d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857053, "uuid": "3176e710-84e0-4830-81cb-4fa0a222195e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17f22f0-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675885390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885390, "uuid": "d83b27f9-cf40-48df-9ac6-00c46d88dc93", "comment": "Malware payload (Formbook)", "value": "3b0295343f0b34fc0ae4951c48911dd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885390, "uuid": "eacb9453-335a-487d-9186-82398b8e3970", "comment": "Malware payload (Formbook)", "value": "40c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885390, "uuid": "0fb3518d-9126-449f-bf21-1fe89f7231fe", "comment": "Malware payload (Formbook)", "value": "52a2bae7cb6bc5d1fe53ec58acb2cfb86e238412", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885390, "uuid": "f983dabd-4610-467f-b999-b80eb3ecaea2", "comment": "Malware payload (Formbook)", "value": "0208dac1de904e0cd59527ab3abcca88c2a54a0d8762bbf60f7274cdd02c5b693a9847b7183b4ffbd5fefe3de77079db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885390, "uuid": "f25d455b-5248-4c96-87c4-8eb2e3ed3c4c", "value": "T11715DF1563A4CE42E1B143BC8AB2EBD017B3B93AD1A4EDC49DC56CCE0529B5039477DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885390, "uuid": "1fa6db42-9648-4704-b02c-dd97d694a4e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885390, "uuid": "50500885-3567-4721-b13b-c6a7e7d2ffe2", "value": "24576:wlpDTpzMxnwlwOXSN3DMDFamQwdqWUnm8hhgxwMYenlp:w7FSnJ7wdqW6mZxwMYen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885390, "uuid": "cc834bce-cd58-453c-b7da-bda5ee4cb3b6", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885390, "uuid": "fc46d07e-f4f1-4c4c-9945-e45622bf2193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885390, "uuid": "361a2e60-c34c-467a-b0cd-8632c91924e4", "value": "3b0295343f0b34fc0ae4951c48911dd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55969ec-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881558, "uuid": "2d9b1a4a-6142-4980-9a9e-8b6f67eec315", "comment": "Malware payload", "value": "316e114e127efd12f739705c9933c4b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881558, "uuid": "b72bbcea-16d8-4874-b0fd-097a04ec6367", "comment": "Malware payload", "value": "40ef7b63ae4884127760d2f99169497e0a96a9bc606fe810ce3a0b9a1fd014d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881558, "uuid": "9891f811-8e3e-495d-abea-052e7bf1fd94", "comment": "Malware payload", "value": "2877b9422c06d546124a6f973a9270043ba5213f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881558, "uuid": "1bb53b1a-c09b-4cfa-a4d6-b0b9c409a953", "comment": "Malware payload", "value": "413c6d713c7616511bebcec4be1fdde86400be3cf6504439bb55c0b3ace3d629fe182ad9f5992f22b158a9d422630b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881558, "uuid": "677ce606-a357-4ff1-8a88-6f2781bee2c4", "value": "T1B4D3E62B76C48F11D5686DB5C0E7983407F2A687B733D35A3F49678A0D023A9CD8ABC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881558, "uuid": "bda71d91-a1c6-41cc-9f38-59c45003a8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881558, "uuid": "80d94dd0-eff5-47ea-9f6a-15b0c8880b60", "value": "3072:U7HrmahEDlVCgNzJSxDpJ0g5LsTyv7hBFfo:mLmuiCg6fL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881558, "uuid": "167995b3-6155-46c9-92cd-4892d6889885", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881558, "uuid": "7f75aaec-3694-4835-9355-0bf67c6d67a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881558, "uuid": "b2120491-df16-4c04-8014-d317ba45b296", "value": "CC_Checker AcTeam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cced4768-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885383, "uuid": "8c81d857-a336-4493-bd9c-6a8ba8b38c6a", "comment": "Malware payload (Mirai)", "value": "444455d5cacb810c310c5b52815d495c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885383, "uuid": "bbb05671-3093-4db7-817a-88f82cb37604", "comment": "Malware payload (Mirai)", "value": "40f89ecb2c16d2ab4ffa40ac2d92d1837a23e9cfb625da028308d0c5e0675661", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885383, "uuid": "611f5ca3-86e5-455b-a76d-26337dca7e4e", "comment": "Malware payload (Mirai)", "value": "e5ee4509a979c340e11dea9b17d272e25497f66b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885383, "uuid": "d36ee17c-c401-4522-acbd-de8f8c2a75b2", "comment": "Malware payload (Mirai)", "value": "42fcb6dfb61e227f120d188e1213848f7025aa1c5fc2102cbee14386e650aa6304edbd324f532b3e4e05cc8593120d4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885383, "uuid": "6b06d90a-79b8-424f-b9ab-3a1acc5b1d8f", "value": "T191C34C46EB408A03C4D51775BAEF42493323E755E3DB33069918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885383, "uuid": "0ed4fe11-7405-47cd-b62c-ef017a5988ee", "value": "3072:7Pe4R72PFYKav6ucJAs1R1Oo+W8oxVbJz:7P/72PFYzv6ucJA0RJ+W8oxVVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885383, "uuid": "62bb1229-c692-432b-b229-d6b208f2ff0c", "value": 125778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885383, "uuid": "3f7efef9-287d-449c-9270-3b4086191508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885383, "uuid": "00cc0311-353e-4dee-9c04-7d26ed3f69b9", "value": "444455d5cacb810c310c5b52815d495c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd9bc9-a7a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675856557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856557, "uuid": "52b9d36d-a079-41f7-8ba1-5f52edd2faef", "comment": "Malware payload (RecordBreaker)", "value": "87f80dc00b839cac4094f73858a36338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856557, "uuid": "9c0206bf-58a1-4c66-8e4b-6095d2e79a04", "comment": "Malware payload (RecordBreaker)", "value": "410ea4ce459105ac9128c8907e3a6962ac880fe45a401499bb6109669dfea680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856557, "uuid": "7fee0a35-a8c5-4bc2-80d2-6b5d081dc9f2", "comment": "Malware payload (RecordBreaker)", "value": "5635bd84e28bb3e056c11843abc3880f1c9bca8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856557, "uuid": "fe29e410-6b84-4ac1-95d2-d580c9fa7de5", "comment": "Malware payload (RecordBreaker)", "value": "e7b4025fac0a8657b0d74956ce68331d5f2bd4d069ceb936659af78a505272673633bf42ffb70fba57886dde407dcbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856557, "uuid": "e4b6b4cd-53d5-4fa7-b352-cdb4bd461eb0", "value": "T186644A53A3D17C48E9268B33EE1ECAE8F60DF550EE4A37693258AE1F1870172C563706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856557, "uuid": "626ad301-7e22-4703-90bc-b9edc724835d", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856557, "uuid": "0ae053cb-20b9-4472-989a-87fbf9a8574a", "value": "3072:ww/WqzFlyGtRlTTApEkUHWJny0Wz5317NOCOsfemWByUAl163BWnU:wjiFsQfApEvHWc0k53u8bWUjUIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856557, "uuid": "bead90ad-56e7-4cbd-bfc4-415467fb4ad6", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856557, "uuid": "b267394c-535a-4c74-b77f-269617a0c120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856557, "uuid": "7404b3f0-d01b-4254-8514-8fab71f9f814", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52726ca2-a78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675845234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845234, "uuid": "fcd8f827-1097-4232-b1ae-72014962f8d3", "comment": "Malware payload (AgentTesla)", "value": "a399708382575d020cba6aa4512e2c26", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845234, "uuid": "809f85e4-9daa-4b9b-a632-cdb19f08929e", "comment": "Malware payload (AgentTesla)", "value": "4141f11d11688c9a8bf113b68c41d0fa8b320afac02e5fb4d5fcf21e641da7ff", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845234, "uuid": "d813cbef-b422-4720-9db5-e9a8475aaa05", "comment": "Malware payload (AgentTesla)", "value": "d67271bae6d55829696923c6505fd14f2723c884", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845234, "uuid": "5f511855-1cbb-4e51-a930-c069f08e11d4", "comment": "Malware payload (AgentTesla)", "value": "e4a87483f631d281e4a9d151dc758638d773599cde9515418ab6d80eb0bd471b05a295adb16e1f06f883235a66c45169", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845234, "uuid": "2ef41a51-068a-4ad0-a1c6-0e2d33f4ee4f", "value": "T1BA84232592EF6509C5F67711E5B8639A22AD5CD52F437AC3B28C30FAF3580F302865DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845234, "uuid": "93189f23-7ce9-44e5-a0df-a471395b9dcd", "value": "6144:Qy9mW8j4PYYnRE7Jpd9j15RieluglXSZZDgA13bcc8FehSdhS2Zcl:TwLjyzWt15k6ugpuZN3gNFSSdbZcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845234, "uuid": "5c2496d7-1f88-40d0-86cf-a11ba2b23394", "value": 393335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845234, "uuid": "e0bbb843-5912-4c6e-b274-0ee0c43da54b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845234, "uuid": "1b4374f1-b50a-4e24-8f4e-c7ada1d161b7", "value": "Swift_copy.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438b906f-a75f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675826311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826311, "uuid": "5ea7f8eb-8a91-4fae-86e2-ad49bef473ed", "comment": "Malware payload (RedLineStealer)", "value": "775ff5af83a841cd38d17f0e89850d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826311, "uuid": "717adefd-2314-41e7-81a6-00268883e6a7", "comment": "Malware payload (RedLineStealer)", "value": "416d0f5e93bd4249b00d6907264d870401255dba0fa4983017ae6f34af36dc1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826311, "uuid": "d6a1692a-6062-45d5-94c2-02941bfbcf8c", "comment": "Malware payload (RedLineStealer)", "value": "977a6139d96c3d0289b3f6ed9ec54ed2ecc0247e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826311, "uuid": "c99c658c-bf29-4f37-a2ee-2f821de410f8", "comment": "Malware payload (RedLineStealer)", "value": "9f73e7d64578248f3cf7e73d1d66a71b5780551f8a0c8b4c7b3d15f3718dc38a2902def699febcb4db3e7af6f583bed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826311, "uuid": "3569e658-04b3-466a-aef7-33eca5f2dff8", "value": "T18606492439EA501AF173EEB95BE4F4BA9A6FBE333B06545D10D00B872723981DD8153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826311, "uuid": "42fa9310-ef12-4eac-90c8-103ae91c315c", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826311, "uuid": "3fd0f168-8078-4f39-9cdb-89a80e6ef88a", "value": "24576:508GeFzFDzPLDP8c1uAowyLQfB/eVjKIOQaBcM707ae8gpeJF+kR8YD2Y35/5Mbi:Z/TjrHWKWDOQko29ueJsq8z0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675826311, "uuid": "1822d78d-5698-4a35-bd85-97091775521b", "value": 3654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675826311, "uuid": "85158656-1f6e-4bc8-9c4c-cc2b969a7d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826311, "uuid": "51c60af6-5a16-47b1-909e-dd6e2104bae0", "value": "XWorm-RAT-V2.1-builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f8ec54-a7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675870557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870557, "uuid": "f27bcf98-5ae9-4558-afe4-d1849dfddc4c", "comment": "Malware payload (AgentTesla)", "value": "302e5ee51385dbfb172fd9c590c755df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870557, "uuid": "0a285d8e-8f62-4d06-a5bb-804dbbeacce7", "comment": "Malware payload (AgentTesla)", "value": "420a5c46e9bf188d8e3b8b66732101e4f4a5626d6094979f2ae072399f391412", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870557, "uuid": "8321ad9b-0430-4641-9138-b48366abbacc", "comment": "Malware payload (AgentTesla)", "value": "584f49d8294c6466f0be47db6b607c3334bd4571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870557, "uuid": "64d28d29-86c5-4912-b782-cd7d808ff7cc", "comment": "Malware payload (AgentTesla)", "value": "569480380500a4862ddb55e8075e552edde5e923aad4bc4877680980f5c9e578fdc462f80dc03e7eff0ba24f5e084505", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870557, "uuid": "d813131c-b5c4-4de8-a1a9-d9b1319213b4", "value": "T1D76422103370C99BFE334672547A396B9AF6A93748F09A024710FE0B39553E29A8D797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870557, "uuid": "2e5cb429-3395-4770-be10-b9d68f49f66e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870557, "uuid": "63123b65-f16a-4b5f-a629-bbe8e2e6e5eb", "value": "6144:vYa62zO44zeg3kB6tQXpsN+AREbsPHHnuIgln+cblkA21:vYAzO4E3kB6uZ4KgnuP+cbaAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870557, "uuid": "a6197aea-aa7f-41b2-ae9b-bb722cca49cb", "value": 336088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870557, "uuid": "c6ab030b-13da-4ef0-8e1b-523e1898581d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870557, "uuid": "1693533c-257c-46a7-bfaa-4bbe4d3f7803", "value": "TT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee55be89-a7ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675865682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865682, "uuid": "55240c2d-98ec-4b82-a002-4b75c536c68b", "comment": "Malware payload (CoinMiner)", "value": "fa16f033826b5b9280af4e78117043e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865682, "uuid": "cbfdab6a-93c9-46d8-bce0-233687722de2", "comment": "Malware payload (CoinMiner)", "value": "421e6d2f2ed8dc3fb651f7d3c6880bfef5f8c22f8fab2569be2af7c4b60f2353", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865682, "uuid": "cbf67ca4-d4c6-4d85-92da-d99717f59d60", "comment": "Malware payload (CoinMiner)", "value": "ce251ed583af716e245a4375cc75cb9bf6744e50", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865682, "uuid": "08bbd20f-4129-4982-b3eb-e6b02b1ba634", "comment": "Malware payload (CoinMiner)", "value": "13eeab99c00f8285023e9ff7625c17071b5957b103420401b693d3a6f6b6537ac31a4538242bb88c42aac089c8834f03", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865682, "uuid": "ff0402d6-13af-4cda-b224-a4666828cfbc", "value": "T133644A9397E0FC40E9618B33DE1ECAE87A1EB9508F1D77769218AE1F14710BAC1B3615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865682, "uuid": "70023091-09e4-4e03-9e14-a0ba086c9636", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865682, "uuid": "2693be21-f0ff-4ee4-a29b-4ba5aeacb43e", "value": "3072:BPWqOIKRNoTjvUyQ6A4iFOUEralt+HBrzNjpvSyrxGJw7URLStKRxhUw7RPgv:B+T9oHcyQ6eArt5jpXrx3UgtKB7RPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865682, "uuid": "b6321883-2493-4457-85a8-f6fa8149dbed", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865682, "uuid": "002f62f2-91d8-4a82-ad59-63f5ad9b58c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865682, "uuid": "7962f00c-519e-4408-9765-3d0ae44f2233", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aeb669-a7b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675864651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864651, "uuid": "ff6bf27a-5e45-47e4-bf2e-8d5302cac9dc", "comment": "Malware payload (GuLoader)", "value": "6fd1cea0b6456fe415fc1ab847c496a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864651, "uuid": "2e82f806-0bc0-4f9e-944b-90e08bd3cb15", "comment": "Malware payload (GuLoader)", "value": "429331c98127e0d6e5fab017e521c8285664d799bb100a93858807549af9f30d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864651, "uuid": "fa63334b-6a5e-4d3e-9ad5-fb5dfd3cde1b", "comment": "Malware payload (GuLoader)", "value": "a2094164845bdadd004aabffef4776ff675524bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864651, "uuid": "0c04a4ba-d878-44a2-9dcd-a5b8ae84454c", "comment": "Malware payload (GuLoader)", "value": "1fb9f4d6e44fd4dd0e1c6337edcbdd153fb9ad512f2026cd284c2439c7ac016d4a0f74b39c4f6d8f541d3dc84430da9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864651, "uuid": "6f550c19-c76a-48a7-b46a-26a3b5044931", "value": "T16AD4F168FF10E80BD95A0F380C95D5695960BE402C64CA23B3E3BF6F7E7A6C3B915146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864651, "uuid": "dbe36a9a-c684-45d6-9e66-01b96179465b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864651, "uuid": "7de0f636-84ae-4bf6-8660-b93a594058d3", "value": "12288:Kbif/mHZzu6uhuQgRN6Zuj90Z2upnDPV8fyYkAAG8VJ/TGqbr3MBg:0if/mHZzutuQgHt90TnDPVNxK8VbE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675864651, "uuid": "47266b25-ba4d-4360-8abc-fe5776a318a7", "value": 639456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675864651, "uuid": "c97fbbd2-45f8-4bb6-9026-175051d923dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864651, "uuid": "9383632b-6f96-4da7-8736-1c6514a9b24f", "value": "02-2023-Rechnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e84e697-a759-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675823672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823672, "uuid": "891f71fe-3a54-445e-946a-245d18b6bf4b", "comment": "Malware payload (Amadey)", "value": "ec4f9606ee82ad063109fc30a04ed347", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823672, "uuid": "1bfd93f8-90a5-4f2b-8145-21545c8950f1", "comment": "Malware payload (Amadey)", "value": "42c4f36696fc491399704a026c8907f8dd037311473e321bba7be52ba19b3ef4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823672, "uuid": "1c235fb0-d678-43af-b014-0dfb03c9af70", "comment": "Malware payload (Amadey)", "value": "3a807fffb03d93d65c59ce7dfa2c4d46e5e44b4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823672, "uuid": "4f2e9c48-7934-42c5-8833-09182069c71a", "comment": "Malware payload (Amadey)", "value": "82b7a6597225eba701ccf30c252f792b97ab4edb72ef1655b0b3800ee4bf1f628312212f02c1dedf6eda331658d5da24", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823672, "uuid": "1cd41100-1854-4611-aa64-3fe872a77d32", "value": "T196B4024BB7EC4122E9B51B701DFB06C30A36FD515738939B224E6C2E0CB26A4B53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823672, "uuid": "af0f1a1c-62d8-4052-87fc-eecd313bf5c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823672, "uuid": "6a2922cd-59b4-4e27-bb8a-794ba996e8b6", "value": "12288:JMrpy90cOvFksuR5HFieTe4/dZCcPVccZaajjEOiL5NOFvGt:gycv5QPL/TecUajDidNOFut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823672, "uuid": "0cb07642-664b-4146-8eb7-a20536dad52d", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823672, "uuid": "8c227651-2ad7-4fc0-b0f2-359f8e5c459f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823672, "uuid": "d0ab3b2f-34f8-4fee-9e6d-1755c1199633", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8de24c9-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675859123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859123, "uuid": "9273b91b-c86f-45db-8d54-2839ae20098a", "comment": "Malware payload (RemcosRAT)", "value": "51952fb9015646822da13e0f9eb7dc27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859123, "uuid": "8c4654e1-17a4-4eab-b9d2-c41da6cf5d67", "comment": "Malware payload (RemcosRAT)", "value": "42ebfb359d58363eee54ab0096b6caf730ba321ad556bd0ebca34296b8d8b2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859123, "uuid": "1ca7a3b8-c14c-4f78-a799-1457750fe49a", "comment": "Malware payload (RemcosRAT)", "value": "ade02fe4bb38b5dabb903595771d94edad47cd88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859123, "uuid": "c0140172-5632-48e7-a368-5b3768c956c2", "comment": "Malware payload (RemcosRAT)", "value": "839c40ac211c2c91a6be090bac569ddc2ea20de56b7544a1200e82eb863ca79ea571e8c3c5aa547e635b4e08bf87d4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859123, "uuid": "c4eb1328-7c54-41c3-8705-6f351b8fb546", "value": "T1865540B8A8BB4A99E00FC9911BF8FCF8117671F3DCE20DA5436C77445E2AE947E0550A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859123, "uuid": "bb4e216d-7dd2-4811-a0b2-745ddf26b0be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859123, "uuid": "c7465807-d0e0-4d06-8116-53643c48281f", "value": "12288:TyMy06HLrSepN+l1vVGOeuAmY94Sm6Qpy55Pa4vJOgOEMwnkKO:dPkLP9JIoDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859123, "uuid": "108799cc-26d9-49d9-9449-a015db3ab443", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859123, "uuid": "fce7adba-e90a-41ca-b5e5-c24fd59d3838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859123, "uuid": "b6f4e822-59ba-4c50-82bb-bc555ffba5f7", "value": "Jvekbka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c80aee-a785-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675842827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842827, "uuid": "710e2f21-39db-46d5-8326-f2da7fe236cf", "comment": "Malware payload (RedLineStealer)", "value": "952f4a2a701d5b0ae939ffa7df8f4da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842827, "uuid": "ed3c09b8-bc65-404e-92b5-97225961455d", "comment": "Malware payload (RedLineStealer)", "value": "43326f2a658edfcfc3cc14d8612257df54b2ae5dc1cf68464cd4e6561baf172f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842827, "uuid": "aba8b8ad-39e5-4560-8751-6b548b6befdf", "comment": "Malware payload (RedLineStealer)", "value": "bf284b37c4c230fa65ca25bbae83bcf2bc6ea6b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842827, "uuid": "13724abc-bf0d-4e16-96ca-8b53816fdb29", "comment": "Malware payload (RedLineStealer)", "value": "e779db70a78be0d13cc2d4cb7df247edf99b2fd18c9a1a140c185c7804cabbc36e2a8262966071e03cf586dd96bebf37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842827, "uuid": "da2f2900-285a-42ec-ad84-bdf4e04f1efc", "value": "T172C4021BA2EC5432E86527740DF706C31636BCB15B39935B274FAC6E08716A5B23237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842827, "uuid": "ed3ad91c-db10-4b64-8a91-4158632f3c9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842827, "uuid": "21186759-a2ef-4faa-8251-a22a04e6ff0c", "value": "6144:KXy+bnr+Xp0yN90QEovVJA3grbyJGe5AdTxyxQI+AmxySBxiQ4fv5dPSfsKjRurs:dMrvy90WizGxlIfQaxdPSfurmlkly4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675842827, "uuid": "7de39837-594a-4451-8d7a-970fafa2a46e", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675842827, "uuid": "b4d67f0d-8dce-4a55-a994-0c248a43d2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842827, "uuid": "e2be7120-0c0b-44de-a63d-0edd85f1c026", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48e60a6-a748-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675816676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816676, "uuid": "a2ca3f9c-92dd-47cb-a646-648ffb89f2e3", "comment": "Malware payload (Amadey)", "value": "7b43ff1b82bb584ef6ce7ac088c09ebc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816676, "uuid": "f4099b77-924d-477c-ba4a-01f3f64eca42", "comment": "Malware payload (Amadey)", "value": "43757a74d4941f7f5dd9d46f70030c4ac379f7178c22d40043873fff4f659232", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816676, "uuid": "16088aa4-2192-4aba-93de-f1b5a601b3db", "comment": "Malware payload (Amadey)", "value": "f0dab84abe7b391d1359594c6cc223a090301efa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816676, "uuid": "280ad533-49ce-41d4-b94d-f7d1bc1c7689", "comment": "Malware payload (Amadey)", "value": "39b55d77b6cb5f3d775c7c2833f0d2ed7a7f39efc7149e484fcf42031df30bfbaf79ce4530775d984bc2d8fb8f5529e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816676, "uuid": "8f87655c-810a-4330-b172-2d80c2c1914e", "value": "T11FB40217A6F89131E87517B058F303C30B3ABEA1563C834B274EAD5A1C72665B63277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816676, "uuid": "623a6a76-8e85-4bb0-8df6-92fb39390dfb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816676, "uuid": "b56bb9cb-958b-4948-8f65-48772f9cb16a", "value": "12288:2Mr9y90la3vJeU265DRTQkPRP2FJdd6cXWth15PP0G4:nyh3ReBAQkPBM9PXWth15Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816676, "uuid": "b00d8049-96ee-4d2d-a21c-50c1268ac8dc", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816676, "uuid": "10a05a9f-6677-4078-85a8-4c4ce13cde1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816676, "uuid": "e683a95d-28fe-4dbd-adff-a281e6019bd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15d7102-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675881551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881551, "uuid": "aef150c8-f3c5-4085-88ba-ec7b0c091f5b", "comment": "Malware payload (Amadey)", "value": "41ad6ec29b0976b8feb5324d406f2893", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881551, "uuid": "07ac550b-befb-4b67-9ee9-8b2e496b3671", "comment": "Malware payload (Amadey)", "value": "43a0a561e566f69014e79eefbdda5891b324a15ad69b74e1ded1a531e993390a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881551, "uuid": "f2af7a0b-4c83-4196-ae9f-1dfce92f26d9", "comment": "Malware payload (Amadey)", "value": "de5ce54efc2dcc2a5e0ae32c2ef1d07885b8fdfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881551, "uuid": "55da3983-9b1f-45e1-a80c-8bebb364536a", "comment": "Malware payload (Amadey)", "value": "b6c6e611ee753ea45133d88883bbdf2513f04297ea17147fe786184ebd9eb82f68d5d887046b89ca7dc3dac30f63cf4e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881551, "uuid": "492d0256-de3c-4790-a63d-395f7c538a80", "value": "T16DC4020BA6E88032E4B557B01DFA03C31A35BEB15F3C435B164EAD5E18722B47A7176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881551, "uuid": "d892407d-7037-429d-aaca-8b1e202cc5ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881551, "uuid": "e698534f-9e55-463c-b9b0-a938101ccec4", "value": "12288:JMr3y90b3DpMYwKocbUisE6JQsHcG6ib18J6Z+czU8m:WyEpMYwvcgfE6XFL+czU8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881551, "uuid": "c9a7f297-fd20-4093-86ca-5aca2150a7ed", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881551, "uuid": "cb047520-ba79-42d8-bd86-4c60b225f635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881551, "uuid": "5aba1269-6b8b-4f54-8b31-21891ffdc8e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5977643c-a789-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675844387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844387, "uuid": "a7d4b088-a548-4280-a85d-ef9655a4a4f5", "comment": "Malware payload (RedLineStealer)", "value": "2be4ebd26ee85ea61a8cac655931fc17", "object_relation": "md5", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAlchemicWorld", "colour": "#7F3208", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844387, "uuid": "b0991e66-6a5d-4cc6-9ad7-5cc3fb126709", "comment": "Malware payload (RedLineStealer)", "value": "43f1fd493804d7786d9aedd1ed6af94e88ed0cdda7f0da4bc95856ce295ecb6d", "object_relation": "sha256", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAlchemicWorld", "colour": "#7F3208", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844387, "uuid": "25ef0974-90aa-4baf-bf84-92fb5ba8c537", "comment": "Malware payload (RedLineStealer)", "value": "5577eb2c17727403c2b9f2e7b879677a52aac315", "object_relation": "sha1", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAlchemicWorld", "colour": "#7F3208", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844387, "uuid": "fc557681-c0a0-4e17-a5fd-c0eb28c0b587", "comment": "Malware payload (RedLineStealer)", "value": "c06c51c61cd0c0d17574ef1664c080ebd45200542ac0ec7e372674fbaa8fc572344f4efb34b2d9867987699027957fc6", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAlchemicWorld", "colour": "#7F3208", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844387, "uuid": "c18c42b4-63da-4681-8e6d-bb5fdcfecca8", "value": "T1E656235A40EF53F8CC838AA8994918DFB8D5617D46BD762D32C18C02E672EBD45C63B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844387, "uuid": "c4588c68-7b4f-4b2c-ae48-669cc2b17805", "value": "9b8015e27c54b17330ad03cb7eb324c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844387, "uuid": "30c6d936-fa3e-47dd-acae-7d88e554804b", "value": "98304:CzcslwPEH8Blb8TTSHxoXso9No+wMwKtlNVOuCt+09u7YPhD:CIs+sH8aTSHGXF/YMplLCWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844387, "uuid": "9332d200-6aa9-4bcc-b4a6-df108c78c705", "value": 5945856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844387, "uuid": "9f5140ed-580c-4e12-a232-0fa237e05707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844387, "uuid": "230afd00-3925-4d6c-b0b4-0809dfeecf5d", "value": "Magical World Launcher BETA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8e663-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675852011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852011, "uuid": "27fe2b21-356b-48dd-b6e4-2a0aa2ce5ef9", "comment": "Malware payload (AgentTesla)", "value": "43ec9500419801834b7c678b9c67feb7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852011, "uuid": "575d87c1-b013-4e32-a762-1085729d27a8", "comment": "Malware payload (AgentTesla)", "value": "447075b588643beb858a4ea34eb5355935f562f86f0a7e70dd0be57e02ef68a7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852011, "uuid": "ee9f1ad5-a7e2-4cad-98cc-ec953a220ca2", "comment": "Malware payload (AgentTesla)", "value": "8650d1824ead688befb0aeda064e3dc12dd34060", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852011, "uuid": "e29ac683-6e80-4379-b4b2-6878b56e45ae", "comment": "Malware payload (AgentTesla)", "value": "f87f4e98138347b7e03b42a0f049ed2d97cde18075e9c666c5dc3040ef0b29a940c2ace5c431ac31a8eb637fa23ff3fd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852011, "uuid": "3ef1d687-b916-4397-838e-dc5b83c1beea", "value": "T147A4234DB11AE156CDCEFB317C4D2F72298E610A127EA0ACA367C5E83686D3D8F17914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852011, "uuid": "3a8866db-6f10-4206-96c1-74dfc7c5a989", "value": "12288:naW7YSSL/uhpHbnkFPTZ62jhBXEXkkqxwt7NNcpWhJ9:naWLQ/URkFPTc2jHUUkiw3Nc0hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852011, "uuid": "a2173d00-0fd3-420c-a17b-20e9a9752f49", "value": 482367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852011, "uuid": "b1985bc6-b271-40e9-8fb2-8df38894e438", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852011, "uuid": "ceb6accf-dd14-44e0-9ee3-c47ec06979c1", "value": "Credit Note.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91180b5c-a794-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675849204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849204, "uuid": "5fd406ea-8c83-488d-95d4-ce9eb1bb1c0b", "comment": "Malware payload", "value": "23fb0a4c57023913654aaee841607627", "object_relation": "md5", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849204, "uuid": "9d4c7ffa-ee04-4ad5-aeb2-a067e094d58f", "comment": "Malware payload", "value": "44abd30e18e88e832a65a29ce56c9c570d7f0a3b93158e5059722d89782a750c", "object_relation": "sha256", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849204, "uuid": "b999c22f-aad0-48ed-b9c5-fb0ea0bd83d9", "comment": "Malware payload", "value": "dcf851d132104cff226c980a468ac22602a8c0dd", "object_relation": "sha1", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849204, "uuid": "96a8a152-4341-4d87-957d-38380bfbc455", "comment": "Malware payload", "value": "650e402d55b0d30d4d3f1efa9c41eef4aa787fd75146e587d9a97461264eb5dfda502aa9db1bd81009f9999f98383efc", "object_relation": "sha3-384", "Tag": [ { "name": "GLS", "colour": "#01B43C", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849204, "uuid": "ec4fcb04-8087-48f1-8034-5b7832177ef4", "value": "T16B33C65AB79AC846E6552B364CE6C6EA7336FC406E5B83073244B73E2FB5690C903707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849204, "uuid": "d6194200-ce68-451f-8475-bc75a6b8127f", "value": "1536:vSlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0o0VkRmopLBG5/Kz:vSlYkEIuPm3fNRZmbaoFhZhR0cixIHmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675849204, "uuid": "bf3f146a-f950-4bd2-a443-b3fb8f373a20", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675849204, "uuid": "cf1599d3-c5a0-4081-a708-09f13811bf43", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849204, "uuid": "d31d01d0-f2ef-4449-871b-c53af110a448", "value": "RIMESSA_CASSEGNI08002023-8738.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0428fe-a7e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883901, "uuid": "e439f12f-ac58-426e-ac01-b2530f659d56", "comment": "Malware payload", "value": "3b99c206ad289c0f9a22aff28616e905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883901, "uuid": "77ebf07d-0f4a-4e0e-9215-2cc11fe2020f", "comment": "Malware payload", "value": "44cee2982cc59033bbec968f44ac67463f286dc9779b0a8cc0fd7083a55cc227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883901, "uuid": "d2d1dd64-120f-49c5-af7e-a85e1543bdd8", "comment": "Malware payload", "value": "0c79435e2e44994c9e965255d891b18d9e6f460d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883901, "uuid": "edc1993f-1297-49c6-8f33-b17208fce641", "comment": "Malware payload", "value": "c74554da856b8d0295251cd4d28a84a0aeb952d9caf8eb06e096aab13679b3ba12112ac9d0d239db3ed0c0336f7d41fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883901, "uuid": "57487eb9-8a71-4859-889c-840ef54b0d37", "value": "T193C40217F7F99032E4B4177018F302D30576BD600A7993AB275FAD6D58B26E0A2317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883901, "uuid": "26ecbfd5-8b67-4253-8139-7040ccb74221", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883901, "uuid": "266a1d50-3f93-4694-b6a8-70ae9ab918d0", "value": "12288:gMrgy90bVypCd93B2zOq275IDwdY9jcXoqmbC+bG:Qy5pCdj27PtyoqICR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883901, "uuid": "cc810e3e-3831-4d58-b419-e2f2260386da", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883901, "uuid": "38590881-cb5d-4b81-b4f6-92560d0758e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883901, "uuid": "0384b8e7-9470-468c-b417-f6f6dcbc0db5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ece0364-a7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675874434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874434, "uuid": "eae83605-ab28-4b93-a693-80827b6a3bb3", "comment": "Malware payload (Quakbot)", "value": "41772dc21ceaacf67da796ed864e86d2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874434, "uuid": "099983c1-d65c-4a63-b259-7a01dbbfa50e", "comment": "Malware payload (Quakbot)", "value": "4506cd463975098bdcad837059aefb8bfee00200e1eae25c6ebfaff14f564f2c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874434, "uuid": "f3558f2a-ebb1-43c8-9c25-de0b4fe4b6c6", "comment": "Malware payload (Quakbot)", "value": "822fefd4569f5ca25cd2b2d3662035555a7292c8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874434, "uuid": "bd4cd38e-00bf-4aea-8e90-f5689daf8a24", "comment": "Malware payload (Quakbot)", "value": "f207278b447a0523269b53db694212f3409e52e9cf52a78b050e25a1d773bd323d3e8512e2b9615ce57c301128f566b0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874434, "uuid": "540aab7a-720a-4e48-939d-5536fec023ff", "value": "T1222180F7A62492EE096088276625390715C4CC2B0CEF428F3F6959E6FB5CC5407AF7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874434, "uuid": "d83d3df2-f4c3-4da7-af10-bc8583140484", "value": "24:xO0zZpwmchvZAdq7LnUsrhtJUFhtJUVw8TKJDNdhUCM9iVBFYsemsVs6mv+:k0zZp2KdqvnUihtJqhtJ0xTSMpbmoBm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874434, "uuid": "7253e12b-5e46-4504-b062-95a025e820e6", "value": 1418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874434, "uuid": "5be4ca9b-8eb8-482c-8b20-aee82006ff2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874434, "uuid": "3babc5c8-36f8-4047-890f-591d365cf163", "value": "Open.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e121e48d-a7aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675858788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858788, "uuid": "46eca480-7c3b-4841-8771-acb2463b07f4", "comment": "Malware payload (Amadey)", "value": "1332db578659f14b8fe4b2e3456078c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858788, "uuid": "b2e1b4c2-8ebb-4b6b-ad21-72cf8c919b61", "comment": "Malware payload (Amadey)", "value": "452fd06e7d6ecf93278e9696ad649c1be59de18d679170ad4f53080e06320e88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858788, "uuid": "c58db191-fdfc-4eb8-8618-9af395f5c616", "comment": "Malware payload (Amadey)", "value": "0f2ffb15f36ce94c547b014c7a258c184a3f1379", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858788, "uuid": "daf9229f-e32f-49c6-8d4c-1f9b3f0a4e0f", "comment": "Malware payload (Amadey)", "value": "293beb00cc77806115f26acab1a33e40d45525d7ea9d3990d3ad5944140c2f5ac59aaa3cb315e5e41f3a7c94f887280e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858788, "uuid": "c7dbd558-48b7-4d22-a83b-e2c409282587", "value": "T11DC4021BF7EC8162E9B057B05CF313C30936BD516A7887AB234E5D5E18B21A0A636377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858788, "uuid": "77c436fa-cd81-4059-ab0c-153743c0a94a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858788, "uuid": "0762036d-ff84-4bd0-a6c7-a0b03697646b", "value": "12288:bMrpy903MmH+lFTTUcDP2dhq4Y4CPxZlsTJ0ctmvLqbR5:KyQMmHXcDPr4Yx/slBAvLCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858788, "uuid": "f0e1275d-4245-452a-a4b7-ed9e79aa3877", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858788, "uuid": "15e01442-ac62-4457-81cc-c42834088dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858788, "uuid": "503f234a-2536-435c-833e-3aa60a89c0fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bd3542-a7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675869639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869639, "uuid": "d5b3f0e9-9d21-43d1-a56e-9dbc437b34cd", "comment": "Malware payload (AgentTesla)", "value": "19433a72b2f459140be0d510a2902b9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869639, "uuid": "b2fc8be1-73f3-4961-892f-14d20de7d557", "comment": "Malware payload (AgentTesla)", "value": "4532b25d18df51f3b13ee39f59eead70fee8582f54d5ed914db8bc34ace1645d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869639, "uuid": "7ef18622-9d3f-4602-b7bc-b1b942fd7a3c", "comment": "Malware payload (AgentTesla)", "value": "39f41691d1c50d3f08e2df7fcbf05da796e614b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869639, "uuid": "e2eb6060-0534-46ef-a3ac-ee83276a9ae2", "comment": "Malware payload (AgentTesla)", "value": "40a8bacb8801c6f5e7f6a5b618b803c9875a4b536f47a544c25d145942ebe84331ef20f219c3f084660cc16bc1ce5307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869639, "uuid": "b8746347-7d35-446d-a241-2c9be306c554", "value": "T13CB423D7E1721280DA8D6EC5F1C7E3D21912F2BBB5D12BE3E08BAA512D145813B1F926", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869639, "uuid": "6c39f6a1-7fa1-4949-8ec7-fd68435d13c3", "value": "6144:cl1Lm+fPuxNIuZ4RrmHXxLqd4p3JNsNsMrGeNQshSTO4Tg9e9K+P/21osaYZaUpq:iP+bqr6BL0ijm9zmO4ooaosa3Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869639, "uuid": "4617cb79-fb5d-472f-8cc3-5fb1472afeac", "value": 495300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869639, "uuid": "01c09e72-c7f0-4bbc-b44a-147f764bfb22", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869639, "uuid": "e29f88dd-dd51-4e60-a3d0-4d5a15f9ed47", "value": "PO#88224, 88224-ADD.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c32a48a-a747-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675815937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815937, "uuid": "8bef2ffb-d88a-470d-a15d-df2ada550489", "comment": "Malware payload (Amadey)", "value": "8e5c50aed48222bd8763f5ac2b95872f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815937, "uuid": "23077406-f325-4bd0-bd17-322c16c8e794", "comment": "Malware payload (Amadey)", "value": "4539aae66b93e4e98ca41eba3e9d23cd3ef5f73c846fa0e414d1d4d856f60ac9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815937, "uuid": "6b2028fc-dffa-4c94-a196-0ec4910ff893", "comment": "Malware payload (Amadey)", "value": "6f6f053be885a4f491283662b35258fbbd84a474", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815937, "uuid": "23c832de-66bf-4fb9-9e1e-233dfbfec1bd", "comment": "Malware payload (Amadey)", "value": "492008b2eff0872bd00535f66db4d25673ae647385921b937f5177f32cc7c371d92c5e1313b70b25844724fc152ba13a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815937, "uuid": "9c6a9f68-9b12-4d57-a4c9-76527480635d", "value": "T119B40217A2E84433E8B617705DF203C30A3DB9A15739539B274FAD5A18725E4F6323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815937, "uuid": "ad4d1d20-d495-4ce4-b335-2a2d4df398df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815937, "uuid": "88c07ce8-3ee3-4a51-880d-f627675b196a", "value": "12288:DMrXuy90rHdxFxH4cnWUxkPRc2eJdd6cXWtZjBdMk:+uy+/FxH4c3kP639PXWtZjBdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815937, "uuid": "e67e7baf-ba3a-42ff-8a63-fd7fb003db41", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815937, "uuid": "d5462bd9-4db9-4c7d-9537-c9d2fc649de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815937, "uuid": "16446cbe-0537-4991-baed-ed6ad6b59d35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430b7d04-a770-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675833612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833612, "uuid": "7e74d8b9-8108-4662-a62b-3569ae7d9113", "comment": "Malware payload (Amadey)", "value": "4f38f9f92b728d0f52be8f92661e3bad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833612, "uuid": "0f37ff20-f8ff-4126-a44c-87c29f7c5c09", "comment": "Malware payload (Amadey)", "value": "455a64535f0e9c9f1bc697b2e55fc3c1ea218140ebc7788726d75c0eaf08d7ba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833612, "uuid": "0d3f4316-1a04-4340-b14a-8b16f446e273", "comment": "Malware payload (Amadey)", "value": "1d72ab427b2535a348240abf36883cc3e3ac1c14", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833612, "uuid": "a3190d37-3a8c-4d0b-a6e9-d496f9e63811", "comment": "Malware payload (Amadey)", "value": "0da5555664ae3a9ea597467e0f4ef51954b146a3392d54390b28a4592485eee3bb46ff16b408609043b5fd89b41b40c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833612, "uuid": "0bb67ac9-6493-4ee9-99fb-a33e721dce76", "value": "T150B4020BEBDC8073E87957B048F643D31A367DA11A2883AF278F5D5A1872670A53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833612, "uuid": "bb0a81ed-bbb3-4ffd-a4b2-827d40f217d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833612, "uuid": "bb1a17f8-9149-4562-aa08-997ac7a3ebf3", "value": "12288:oMrUy90vQNEVwD3fzlaB3Ooctbx8mvGpyF5xVB:8yxmVkzMZzuxD8yrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675833612, "uuid": "9d420ff4-34b5-437e-b6c5-5d8bbab49f88", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675833612, "uuid": "c13b2c05-cff6-442f-9ba3-71aeb4c789dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833612, "uuid": "606e8c04-53fc-47cd-b834-e7202d75cf43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9f044e-a7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675863026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863026, "uuid": "c4023e41-e3b7-4ce3-8bbb-01570cd1bb02", "comment": "Malware payload (RedLineStealer)", "value": "ca5557f49c2733518a7084d470898996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863026, "uuid": "f37fe634-1b85-4ae3-9617-36a70dc2077a", "comment": "Malware payload (RedLineStealer)", "value": "45a0762a609be8aca923b0e3bab6c969565f2526bf94292ea75e68a6a60e5413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863026, "uuid": "0587a7dd-5b97-44c3-8cee-1d077f4899f3", "comment": "Malware payload (RedLineStealer)", "value": "f99ebd5a8f9e6d98e51517915f9151a5a8dbb348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863026, "uuid": "35b08391-9d5b-45ab-843a-2ecf3645b5a6", "comment": "Malware payload (RedLineStealer)", "value": "c6554ac4ac02dd7acf218a1a6c63e8bf66aad9296a27d68affda839357f502889d60848a740cb9a25cf55c89b46a8e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863026, "uuid": "45d15d8f-90b2-408a-ac21-96b8dcd899e0", "value": "T1BF948CC397E1BD40E9658B73DE1ECAE8761DB9908F1E3776A218AE1F14710F6C1A3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863026, "uuid": "d386989e-18ec-4e9a-9978-409a089692e4", "value": "2f5b7fed6dc1f658f0b63563ffdd4c3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863026, "uuid": "8e6af685-7aaf-49e0-8ab4-50d8afcef6c3", "value": "6144:Xe3yf4JarEwZnSsmRS9NobDCe7gtKB8W:Xe3hJabZnSHRLiggtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863026, "uuid": "ae6e1bf6-6e5b-4de6-971e-f018e2114131", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863026, "uuid": "03829e9b-ce6c-48a1-9a98-28db7a308c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863026, "uuid": "cf3feac2-269a-4ebe-822b-6d8ed45aa428", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727f3249-a7c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868480, "uuid": "6f1b3701-0c72-42a3-8b88-edde67703c74", "comment": "Malware payload (AgentTesla)", "value": "85348a0517930a3c83a508960f220678", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868480, "uuid": "2a80ba32-7186-4b53-b6df-412c2a1f3ee8", "comment": "Malware payload (AgentTesla)", "value": "4705340cecbc474ffcb41a8ae7968093fa35084b3c197d4cf1a1862be648828d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868480, "uuid": "89e15f14-7518-4567-9736-701939309a9a", "comment": "Malware payload (AgentTesla)", "value": "af85a0654e7a6fc89022b7a9c772ddaa4b2ff59c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868480, "uuid": "237e5f26-c474-4d5c-9b72-c4c57e5dcabd", "comment": "Malware payload (AgentTesla)", "value": "0ef1d2b7d0f519ad73c0081519a0f4c487ccb0d3b2222930ce89efa6aeb80a7cb069385a67c130ff2eb8b4786dfd693d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868480, "uuid": "8131f00b-59ba-418c-a3f3-42e2df91016c", "value": "T11205E76D587612E2D8B8FB7016B2C830B59D5C96732BC81D98DAFED23F761422D8E01D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868480, "uuid": "9cc757cd-7cb1-4fd4-8028-f3a94ba8d4d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868480, "uuid": "16953e4a-e3c4-4ec7-9cae-5b8d93a6596c", "value": "24576:YGb8vOztLHKNu+A+/1bfd47JnSJULlWjmu25Q9kdr1q:mJ+WuYkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868480, "uuid": "339eea71-2d1b-446f-b26a-c9d534b51505", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868480, "uuid": "cf20b68b-564d-4415-a4e1-f1d6dc4d84f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868480, "uuid": "7910e089-42a7-48e1-a1e5-b0d3896ff11e", "value": "PO - 12619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4d95a8-a781-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675841175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841175, "uuid": "2db3b914-d910-4b40-8fa6-423ea25e94b8", "comment": "Malware payload", "value": "b7dd2cc66e4749d13619647a1eade190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841175, "uuid": "8143b7c2-13fb-4f86-8db6-bb1557f3115f", "comment": "Malware payload", "value": "47bb3e789789448105a29637ebf832e2567171fca57fc0c6d1ef8af3fba34e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841175, "uuid": "892d6ddc-73a1-4009-a906-6a87bd62d591", "comment": "Malware payload", "value": "25770c1fbafd031f00c2627b1c0f79eb575f92e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841175, "uuid": "955b29d0-27a7-4710-a605-62e060bce210", "comment": "Malware payload", "value": "d6d3e219769def5121c9d6c16c43db9e8f12c8a9dd51be90001acc433c59500d53868a09097599d6903eef1ff0a36acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841175, "uuid": "f2801c71-2c12-4892-84f4-3d063a51acdc", "value": "T185D4BF01F7B804A4E1A792358D734A59E672BD891B31CBDF02A4426D2F33FD64B39B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841175, "uuid": "bba657d1-0749-4637-af9a-5234347b8b7f", "value": "0fa8c100a2cf872adbad38f45d2433bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841175, "uuid": "9b26970a-c606-4b47-851e-87dac1c9b67a", "value": "12288:5kddqo8J6CknOJ97ntg9tPka6oOfw+PN0w+sJFwCiVG1d/wI0Tn1/j3YSlLF1Rz:oqo8/+OJ97ePxFOfbN3tFFEG1d/wI0Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675841175, "uuid": "0374a82e-ae71-4107-9b74-28feddac095c", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675841175, "uuid": "ccee8dd1-a9eb-453d-ad52-08a79b7ea09e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841175, "uuid": "62bf74ba-1b9b-4d2e-a8e2-bdb21929750e", "value": "b7dd2cc66e4749d13619647a1eade190+25770c1fbafd031f00c2627b1c0f79eb575f92e0+47bb3e789789448105a29637ebf832e2567171fca57fc0c6d1ef8af3fba34e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84920100-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675881396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881396, "uuid": "06e3a986-8156-4675-86bb-84364c5c863e", "comment": "Malware payload (SnakeKeylogger)", "value": "7bef0db4752cfa72fa2a6b803399b404", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881396, "uuid": "1a50cd88-6613-485a-b8a2-2b0b3d0c097e", "comment": "Malware payload (SnakeKeylogger)", "value": "47be618f3bc464769ed523f82df8383dfdd60f6c713c1662fbc5b57a068223c5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881396, "uuid": "d2c2fa11-4c10-42ce-8144-21d098b75dea", "comment": "Malware payload (SnakeKeylogger)", "value": "e54ad9a8b00581c8523dfca5230878d72a84243f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881396, "uuid": "3546c0d1-f07f-4336-a456-4bbcca55b564", "comment": "Malware payload (SnakeKeylogger)", "value": "6ac968f3adad567f8f88c5ffa45dc124a6e1477378b535ecd8fd8f205e347d8c95915e0fc4d951e3cf562e6fd56a4168", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881396, "uuid": "676fd761-1781-458a-ab57-db0848df87e2", "value": "T1A5037D5AE78F02A5CF511277231A0A899ABDB33EB350557134AC937433EDC3D42A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881396, "uuid": "402d4a1f-1b35-49e2-9235-889bc26a09a8", "value": "768:nFx0XaIsnPRIa4fwJMgD4mkPpqI89JyAJnAudW4jN0g5+8A23Py:nf0Xvx3EMQCSJDJnA54JjAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881396, "uuid": "86367118-697d-4808-af31-8f5ec998146b", "value": 40757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881396, "uuid": "8d1848ba-6539-4ef3-91ac-a64822595cec", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881396, "uuid": "24aff83f-3815-4a87-9dba-54ee28411b50", "value": "PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3017b32-a7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675874199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874199, "uuid": "08dff7d3-a6d3-4710-ac37-22d79b09591b", "comment": "Malware payload (Amadey)", "value": "1f137eb4c97f4a4d23afd0b73f306528", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874199, "uuid": "c1d6a2f7-98ef-42e7-bebe-ee026563f27a", "comment": "Malware payload (Amadey)", "value": "495c4f3319242797afd9d2e0a6fd711ee31fe2a335687f404e6b82f596555ae6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874199, "uuid": "ddc82df6-153a-498b-8c25-74673ea23f44", "comment": "Malware payload (Amadey)", "value": "b1bf43a56f2e43386d3c2c4452b6427a29613223", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874199, "uuid": "ce8d43a9-89a8-459c-af41-4c08cc6117bf", "comment": "Malware payload (Amadey)", "value": "a6ce6e1f28bd4c2d8f7f131602eb202723956b57836ff61fd35b3a7c459bf285a3bab1ac6349e9ba807327b67d395752", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874199, "uuid": "2ce51ffb-8dde-450f-9fbb-88a73e11d62a", "value": "T14AC4025BA2E89032E8F16BB05CF612C30B367D611A79828B678F5D1F18B3171B53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874199, "uuid": "1cda2a49-d0a1-49ca-a6e2-3717ea9ef638", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874199, "uuid": "985e14a9-f33a-4e7e-aa43-7a54e31a9ebd", "value": "12288:FMrYy90dBDt5SP9DUZ+XI3KokhPUm+q2y6DR:RycJ6Af3hkV+q2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874199, "uuid": "45c6aa02-fed3-48df-8ff2-8a882151ba75", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874199, "uuid": "146420b7-0577-41c1-981c-004301721ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874199, "uuid": "9f52028b-8ee6-48ff-a0d7-021c06d814c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74438b8-a792-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675848517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848517, "uuid": "1e1a6d56-da2d-4fed-b4d8-4b9591867ee8", "comment": "Malware payload", "value": "136064df982e004e5365311430c22392", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848517, "uuid": "5b6fe009-cb4e-433b-8622-68a3dc5df86a", "comment": "Malware payload", "value": "49750b423096eb5cd522955fb4b20479f5825f8ee8664ede05fcbdebb9ad53ac", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848517, "uuid": "e687bc14-30ba-4a4e-b0d7-9caf17937565", "comment": "Malware payload", "value": "99216c4e457a6079fa64c0911cb0631dcbde5bdb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848517, "uuid": "eae13b45-a7ea-40ce-8901-cb6b7705500b", "comment": "Malware payload", "value": "682031a1588f3af74fb850805f8b67711c99857aba39839fb61e77d155fd0c72e534951ffbda22373179e0a5fd04f6ab", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848517, "uuid": "bbd126f6-f26e-4b1e-a635-78707ec63f46", "value": "T1E235E007F176DD2BDE22C57CE88F208282179C79A955CA4E21C2732F5A32BB05D7ED94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848517, "uuid": "b4b7bdcd-0263-4a98-b8ed-c689356a149b", "value": "12288:EFel51BkAfjTFekRtqSdggDsLxdi4u4zTAqEjvjjA7eCU7FeIuQn:EFel9TjTFekRFN2bpEj7jAqq0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848517, "uuid": "aaf9bdd3-0756-4d8f-b471-0aeeaca0b726", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848517, "uuid": "fff3bf30-c02b-4e41-a467-0b552e5e9603", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848517, "uuid": "a672c92e-53b5-4ffc-abe6-888d5027c163", "value": "zamowienie.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b93a74e-a79c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675852524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852524, "uuid": "529c03ea-16de-4414-b83d-ae45527040bc", "comment": "Malware payload (AgentTesla)", "value": "17a5b05617beb9a5c7c3a42f89b60bce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852524, "uuid": "8abc4d0e-103b-4e37-b02c-36fbeb9efde7", "comment": "Malware payload (AgentTesla)", "value": "499e8fe59f6dd5127cbf40263388b2ad5faac3a7c63db886996ad5ee8b82aed1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852524, "uuid": "70292007-9497-46ec-86b6-5298ded92cce", "comment": "Malware payload (AgentTesla)", "value": "837c28bff711709ee5edfcdf477c1455d8e2acf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852524, "uuid": "87568747-b5e0-4fee-8acb-07c81e56f4b6", "comment": "Malware payload (AgentTesla)", "value": "dbe322b64d83b345d9f891d30c44a25149e6d608bc7631e97b4c1405d6c4b5012ed27b223d91b04671191081b2e8820e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852524, "uuid": "6fb37072-b8f6-4180-b9ab-46c0805afa5c", "value": "T1B6C4B43E29BB56E2C578F93986E18420F5AD83923303D958DDDA6BC0CF0168A7DCE55C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852524, "uuid": "e2e2fab9-cdb0-493d-82b4-04856e0792a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852524, "uuid": "abd8ea11-8ef0-4555-9602-c80aea782f92", "value": "12288:ubGqklDne7f4WYMTyPdLX2tuCAe/ZX0WV8s4PIt+0dg+69tZqKgJ:CW7MTyPdLX2tuCAe/ZX0eT4s9w/oKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852524, "uuid": "ac13c920-84ac-4ec4-ade5-061c3d2b11ae", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852524, "uuid": "03926c7d-b7b5-4e4c-9267-9b35d3d69e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852524, "uuid": "09724417-36ac-4104-973d-42c6b4575997", "value": "Swift_copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390478da-a7f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675888570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888570, "uuid": "5333f624-f4d4-4368-8686-4cc709b7e99c", "comment": "Malware payload", "value": "507d6bd95f0f3662b3e639387aecd505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888570, "uuid": "020aa1d4-7055-47e1-83ec-d14b0ff04b5d", "comment": "Malware payload", "value": "4a09f8c6ce34ac6ab5232822672d8848fb702395319e558cfa8eae651b4ea2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888570, "uuid": "9bd45903-047c-4cc0-9e8f-cabe9d8a5ce3", "comment": "Malware payload", "value": "f69223d26cbb9095c8e87d4164277df5352369f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888570, "uuid": "0c43e9ca-799c-4e43-be2c-be9aec1c19bc", "comment": "Malware payload", "value": "e5bb905c7be0c2af2d2c949b0b4ec89933b33e877ba80f2e7c35dae1e9618e6e60d64b975cbda36cc75029cc8e23aaf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888570, "uuid": "db7b7495-6832-4c20-8fde-3d95168a6fcb", "value": "T11A641803D2E27C81F9258B769E1FFBF8765DF6608E4AF7653218DA2B14B0172C663610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888570, "uuid": "117109b2-ff27-4451-888f-f13d9c1131d9", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888570, "uuid": "a7ab3919-9638-44ea-8fee-d857077f5b05", "value": "6144:C3yy5WqZKNbm0lSvz/ZZVKsHqoLiq17XvJ:CCyEY+m1lO1M7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675888570, "uuid": "420e98dc-0345-47b9-a567-3e4b228de5b3", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675888570, "uuid": "cb2830f4-db79-4427-b6ca-a0ddf03f61bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888570, "uuid": "f29afdbd-9a52-4b98-863c-12ab1de35a1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33be062d-a7fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675892857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892857, "uuid": "7ff47084-81c3-46a8-ad6f-ec415bdcee24", "comment": "Malware payload", "value": "dbf9bd0cd67c64d3a76c2e0cb07df579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892857, "uuid": "217b95aa-db11-48bc-853c-40218f4b4b91", "comment": "Malware payload", "value": "4a5160308f596abf7e89f311541f41867740cc29ab865a443aa2b5b913c36e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892857, "uuid": "a69fdd63-02e8-45e2-94d1-df1c010a9bef", "comment": "Malware payload", "value": "23e67bbed6f89cc7a71c4761ac72952f03d1e878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892857, "uuid": "d82a3e0d-21e2-4561-aef4-cea4e80b172c", "comment": "Malware payload", "value": "583188693740aeec94bd43db9c6e1730b0e767f99fca39017cd426bcf5c889a4974c04c74e8e127835930f1b48d853d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892857, "uuid": "3a8e4b24-838f-45dc-8050-ecdeaaa9750f", "value": "T1AFC41207EAE94462E8B1977409F607D31632BF6427389397678F6C5D0C726A0B63237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892857, "uuid": "470c430f-a65a-41c1-83c7-1fd9bc81c778", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892857, "uuid": "1ab4c7d5-ed70-44fe-8572-8be118f4d06f", "value": "12288:DMruy90DSGoavods5Ht22r1SP0igZJPBEIMoUXBhhFH456:Zyd9lslt2YBEiUXBhhFH456", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892857, "uuid": "d141b494-a1c8-42c8-9465-df8ae92ee5b6", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892857, "uuid": "83b2e48a-f33c-4e2c-a4c2-50f2a053274d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892857, "uuid": "b32e15d0-9f2d-446c-b714-f61939a5ef0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0427f0-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675882299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882299, "uuid": "2401917e-45a6-4398-b119-036ea20bd754", "comment": "Malware payload (Amadey)", "value": "96ed7d94ed3c572efc279c685df46e85", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882299, "uuid": "c64048b9-d3fe-445c-bf56-bd888e2c1487", "comment": "Malware payload (Amadey)", "value": "4ae3bf7564bfa4728ca95f5833271a04608c2a533a3703172effdd9bf86c28cd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882299, "uuid": "e01ad2c6-0269-46f2-a5c7-fe5e45b38f8c", "comment": "Malware payload (Amadey)", "value": "403b1b991103cbb6988ffb3276705fc51b0e18cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882299, "uuid": "167c05c6-1a70-443d-948e-51045128dcbd", "comment": "Malware payload (Amadey)", "value": "608260bf00848bfe6ed6f57e6b4bcebe74ec95a0a56f5fdcee7e0bf4dd9ab5b8e9e03f7d4f103379471a8ebf381d5ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882299, "uuid": "2cb6b595-1b4d-47be-81e2-4035573d6d8a", "value": "T1D3C4120BB6E88032EC7557701DF606D31A3ABDB46B38929F128A58590C736B4F63077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882299, "uuid": "96fa824f-ddb0-41c2-becd-52de43eb834a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882299, "uuid": "4b6c6b49-47cb-4aab-8dee-19325c9cff2a", "value": "12288:GMrgy908YFYfjxUyDD5+6E6JtsHBGQJb1zPcW7b/:+yayfjnk6E6yZxcW7b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882299, "uuid": "a426121e-f400-422e-a54b-96dc1a0a4484", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882299, "uuid": "5b8a6e6d-37cf-474c-b571-97714b0a806f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882299, "uuid": "fd6470e4-6fbf-4b17-a431-5618e0ace8f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dc1906-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675881987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881987, "uuid": "160a71cc-3a51-48b2-b195-e920fb296f03", "comment": "Malware payload (GCleaner)", "value": "12f920076b98b818377e7c733235f1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881987, "uuid": "36546f4e-f956-4063-8c32-f138b258c55d", "comment": "Malware payload (GCleaner)", "value": "4bc7bc0cc4e240af0db4f3c7a09e5cdadea4319550ba270e371e7a86982887af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881987, "uuid": "7a38da2f-5e6f-45ee-b016-5fccf4582814", "comment": "Malware payload (GCleaner)", "value": "15c2107fd06d473bbec804a4f7661d3486688f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881987, "uuid": "fcd9c2e4-615f-4321-809c-f82423e9ce8f", "comment": "Malware payload (GCleaner)", "value": "6a0cd7a535c1908c0205f248b619225bb70a6491371847fda2e835668e14cadb433221240a9520b282e4872c15af82ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881987, "uuid": "1a38c67d-0fa8-45e8-896e-40444eb4fc5c", "value": "T10EC5127C7001D4ACD694FEB48836E5E35CDA6EE3E9D49022B0D97F3F92791889B09217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881987, "uuid": "1d1c0ccb-20f8-494b-97d6-64d69e28ece2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881987, "uuid": "dcafe498-2868-4313-9c57-a9681491e0c7", "value": "49152:rdHtropdAZUGtaMhMkFx/z1cgiDDGcvKVW0gQ1tvSOsFqLCgv2MR:JHtrozZGA0HpomvSvCv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881987, "uuid": "03915c9b-5024-4530-b1f4-72a5ce46478e", "value": 2666798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881987, "uuid": "c30d6039-2d4f-49cd-9ddf-7cf27ff4b0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881987, "uuid": "49829b5c-a82a-4287-9414-2b0340e0d2e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e76a9e-a794-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675849103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849103, "uuid": "2331d0fc-9ebf-40b2-bf1e-3957600f18ac", "comment": "Malware payload (SnakeKeylogger)", "value": "714041a2037e7f1219580c06465692f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849103, "uuid": "56858d18-084b-42fd-b4b4-5e1c22483b53", "comment": "Malware payload (SnakeKeylogger)", "value": "4bfbab57c386a9e42854bbe2963e016025cdc68946c0915c425ba301662ce78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849103, "uuid": "944421d3-2379-4b11-8044-ba0ae576b417", "comment": "Malware payload (SnakeKeylogger)", "value": "4b63229de681d770083b3d8a34e452e275293d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849103, "uuid": "4229246a-4a04-4682-bce9-00bf38da818e", "comment": "Malware payload (SnakeKeylogger)", "value": "7f81b5e90f109cfbc61c0deecb6a4361241e81f9b7a6f2c8f4d64207675d63a110065ca9107da6e97473c91b38fee609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849103, "uuid": "43fb8729-2b1a-478c-bdbd-572419fa5714", "value": "T10F15DF25A39ADC02D1A4027D85F2EBD00777A932D053EDCA9ED52DCD061ABA538C77CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849103, "uuid": "f8fe792a-96ef-4447-952d-43615dd34649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849103, "uuid": "aeba3f96-8c3f-45f3-a4e3-443670db08f3", "value": "24576:9jYClpDTpJwMYehLmYuGvk9ETwCdukNlp:KC7rwMYepnk9EdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675849103, "uuid": "aba945b4-82ea-4db7-a2b4-0d6f7d9a8d4c", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675849103, "uuid": "eeb2093c-d2bd-45c2-9906-bdfc0afa93f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849103, "uuid": "7bdc7d23-d4db-49fd-bccb-99adfd298dbe", "value": "PO#00002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9e541a-a793-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675848960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848960, "uuid": "5daf8f35-831c-421c-b5ad-230ddee4f2d6", "comment": "Malware payload (CoinMiner)", "value": "0052bc45bde8b7870e9af0b7c728b2e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848960, "uuid": "19c3fee2-4e52-4634-8301-68756be02168", "comment": "Malware payload (CoinMiner)", "value": "4c13143fda0122c12fe20503fb6fc0dafc93389356e0f9533be3fe3c82e47979", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848960, "uuid": "e3e0df22-30b4-4a69-895c-69ce1c9f2519", "comment": "Malware payload (CoinMiner)", "value": "3d3fe582697d267013d82ca0925e02b1860151df", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848960, "uuid": "c60818ca-9fa7-49b7-852c-8c7edeeaeec6", "comment": "Malware payload (CoinMiner)", "value": "f8c8cd79ee8aa44623c540e390974525d5dcd691558092f369fcd48663e03aba31bdc5cea0d55e7617a6b51f154a4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848960, "uuid": "6aadd585-2adf-4450-ac35-aa0a941182da", "value": "T10D24AE68F5805A7DF9B789F288608CF0833D74C10332E9476A1F19EDDAA4FD0D698579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848960, "uuid": "bd4aa703-a711-4879-8aaf-9d19afb1a09f", "value": "9b78ac986c9f2e3a27f57df355009bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848960, "uuid": "dbb53567-7eab-4ab5-93cd-0ac86df2c16c", "value": "6144:nkgfTliZ8uajyuRMH1KdXvw6vIkLVN3hjOYg+/:nVprbjd9XpIkxN3hjOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848960, "uuid": "5f41ffe2-d5f7-4944-a666-4b3d7d7a11c8", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848960, "uuid": "1b527cc7-c4e2-4b74-8ab3-3d5ae403b6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848960, "uuid": "ade23231-2524-4967-9e59-9b4698eb7e26", "value": "SecuriteInfo.com.Variant.Lazy.294500.701.30642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30d10bb-a755-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675822284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822284, "uuid": "eaeadab1-f3ad-4cb1-855e-58657df1ad2c", "comment": "Malware payload (Amadey)", "value": "a11ff61c2262fd2b2d3076f2a79fcc08", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822284, "uuid": "9f9707bf-b262-4528-a185-925d28267125", "comment": "Malware payload (Amadey)", "value": "4c839855f93bafcc928b1c5d3a12e4f0fd09a6af3c013a3dfbc7edcd1aac5a5a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822284, "uuid": "bfb73c8a-2a1d-44c8-8d7b-313c481c3ad7", "comment": "Malware payload (Amadey)", "value": "546a21ac2b766b57204896781e01966137d4ff9f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822284, "uuid": "53b813c4-fe51-4017-950d-7286ae673487", "comment": "Malware payload (Amadey)", "value": "ef93de71d71a82cfcd3ced61f76777ecb0742e262afe9da85de2e3edde21f053934d688d3a6b0f5243cb4b11c4342c5b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822284, "uuid": "189a694f-889d-4e98-9d4c-303b8ef091ee", "value": "T169B41217AAEC9132D470637009F702D30A3ABD606A74879B375F6D5D08B22B5B63673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822284, "uuid": "ced6c592-b9e9-4b1e-ba22-da7c586fca71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822284, "uuid": "ccf35119-5673-46a5-a99f-264568630c6b", "value": "12288:2Mrsy90PJxq0n6sqWzuIXdlR9a0PCbJr8OEvB:OyAfqG6/mLXndKbJrIvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675822284, "uuid": "77c60c90-53ba-441f-8019-258a00f0e0b9", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675822284, "uuid": "1e89234f-1f90-4364-90e5-747669de2e99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822284, "uuid": "6649cb4d-5e97-4ea3-bb2d-8011fa03578b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ac61cf-a7f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675892726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892726, "uuid": "916e81ef-d0d6-40b5-813b-93ba7a2e19c1", "comment": "Malware payload (DCRat)", "value": "28554b345fff71df728ea7793087e80a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892726, "uuid": "6b79fd5f-d57d-46f3-b059-1a360ec62292", "comment": "Malware payload (DCRat)", "value": "4ccc95e06c986b27d7c3464babae601baabab51998a182f2364bd41a5e0fe67e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892726, "uuid": "c2f31d7a-48d2-4765-bac0-29e25e6889ea", "comment": "Malware payload (DCRat)", "value": "9b7dd192d2ddba056b6e71cf39da6eddf756b479", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892726, "uuid": "db8b487e-3f73-43c7-a817-07f7b5e8085d", "comment": "Malware payload (DCRat)", "value": "0e13d987d32b4e0149606fcee849c80e46485bbbc4ef7f6d6b74688fc16c74adfb0e228b279db1295eb192787a1e83d4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892726, "uuid": "8f530c12-3126-4655-b322-abd1a1b28ad2", "value": "T17C455B017E44CE21F0181633C2FF458857B4A9512AA6E72B7EB9377E95223937D1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892726, "uuid": "b88fd3f3-84aa-445f-896d-61d77111c273", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892726, "uuid": "744b1cf4-9dd3-43b2-9ba6-a2731901daac", "value": "24576:X2G/nvxW3W9BhZRBLdZp7JDCRcL7rx0V6lSpVZu:XbA3kRBRZpJ4uDSp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892726, "uuid": "de19edfe-a41b-43b8-8cd9-41dec58a0384", "value": 1181840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892726, "uuid": "22deaf2c-65ed-416a-8e21-20f93695fd87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892726, "uuid": "44369b64-8d38-414a-9799-e42f97b329b7", "value": "28554b345fff71df728ea7793087e80a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abee55d4-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675856121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856121, "uuid": "2eefd7fc-d7bf-4339-bbe8-b9d1b0eeaf71", "comment": "Malware payload", "value": "38e1f8f90012f7ecde434f660d610545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856121, "uuid": "f5f9b93b-f623-406a-9d52-e5d6ca352f8f", "comment": "Malware payload", "value": "4d3c79df541bf5a8c1095319d72622925dd341a925ce5cdcbc2701cec12b3250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856121, "uuid": "ebadb63f-8878-49d2-9c40-9310c4ca40a4", "comment": "Malware payload", "value": "c0b21f619c72834c896c146fd8caf5fd9dbab310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856121, "uuid": "a8446c92-d12f-4cf6-9c13-0883a7a50afc", "comment": "Malware payload", "value": "f34ba3c271222f920e45ab7b48e06dd2e43508fb804903230cee402e1b4cd2df3661b4da4b2e7286e3e8a084e254628c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856121, "uuid": "1ac762bf-2d90-408c-b3d8-e4832269ceac", "value": "T131B35E0035C1D876FAA656B23890CAE49C7FFA350B34AEBB6394C9391E645D10439DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856121, "uuid": "fc9b2dc4-d230-425d-bb9a-ef178396d333", "value": "3391d25821f027ad2ca25f972b6a2038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856121, "uuid": "a318c44e-7dff-4704-8307-67bc43541833", "value": "3072:Db4ndxBjlOKL6vgdUWAEaCXjnpK0OEqE5yuVL7:Db4ndxBxK8jn9qEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856121, "uuid": "adbe6b4c-6d02-4f8d-a4b1-63375abf726e", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856121, "uuid": "4e50f805-7aee-44cc-b932-e19e0905cfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856121, "uuid": "5b7dc008-de10-411a-9df9-605f56b67ba0", "value": "4d3c79df541bf5a8c1095319d72622925dd341a925ce5cdcbc2701cec12b3250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2beb55-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675883180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883180, "uuid": "37eb8d99-750c-4e60-ad28-77d6a535093f", "comment": "Malware payload (AgentTesla)", "value": "13017ef7f8f6f884314ae0c7aa6f1743", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883180, "uuid": "ce182ad8-513b-4c80-b0d9-e9cdd5959498", "comment": "Malware payload (AgentTesla)", "value": "4d8703870221a21d9b1462b8be0d945e5bbbe03ac9b3e86a12808f1660eb34d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883180, "uuid": "8c7fff56-f83a-4357-a10f-3e50f6ec0f45", "comment": "Malware payload (AgentTesla)", "value": "968cfcfce3d9159bffb2b361af2450a1c9aa77fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883180, "uuid": "27faf45e-1769-49b8-a20f-1f9ebd8fe939", "comment": "Malware payload (AgentTesla)", "value": "b5ff8a3ad41151fac2bc0acea440e6fab70349ad226b277009de5d5e52e874a88ecc1741540f6aac72a413486b67cc08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883180, "uuid": "c67aec35-4ff1-4d5f-876d-58e1935c1f47", "value": "T14D84A16A30EB940550F2EEB36FA7FA59CB7772D567309CAA00CC098A87DF04285357E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883180, "uuid": "ddd357b7-1bb9-46e6-91da-907713ac72bb", "value": "96:fJq3dv7fq3dvzq3dvmq3dvUedjedjedjedjedjed27hpmhqh2edjedjedjedjeda:fQIov38eVxUAzngtCEa6D4Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883180, "uuid": "76703b5f-d7f5-4f9a-9093-850f4bff3aa6", "value": 398188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883180, "uuid": "63916dc1-0f96-4547-87b0-7d2162d98332", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883180, "uuid": "18ca9e08-aa11-4ca6-b653-1a60211bacde", "value": "ORDEN DE COMPRA 80107.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ae6672-a7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675875328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875328, "uuid": "a2a20a22-05c7-41fd-95c6-09720a434a3f", "comment": "Malware payload (RedLineStealer)", "value": "e7495fb200ac5c040bdfeae696d7e3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875328, "uuid": "2d0951b1-0da4-421a-a1c6-c11f1a09fe01", "comment": "Malware payload (RedLineStealer)", "value": "4daa4b6dfe81b31c09d7d3019eef4d84c071962069fd9c6603e810f88182b80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875328, "uuid": "34878194-0325-4e0d-84e8-4d6c5aa5f2dd", "comment": "Malware payload (RedLineStealer)", "value": "423f529ca93e492cac042a88367a608149ef865f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875328, "uuid": "f312bab2-cb5c-4bf7-9c1a-11729f1c3441", "comment": "Malware payload (RedLineStealer)", "value": "b9adc330d3a3fbc03f9dc5a80f04bebac8be939499a529ab63f52e09b878dacf922e6efe0eeeeb902c92cd17851ee327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875328, "uuid": "84d4bd12-f2fd-4b14-aee8-3d6c9a7b7eb3", "value": "T129946C03D2E17C81F9258B7ADE1FF7E8775DF9608E6AB7653228DA2B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875328, "uuid": "1bbcc0c7-4884-4e23-8a46-e01d00fe9dad", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875328, "uuid": "968ce8aa-c878-458b-92f0-f637f7c36ab8", "value": "6144:ZpQ1rrZ+cco+u3llhngGi+lfhiTkoLJvjqLiqTZiv:ZO1XMjqlTK+lWkoLJvjCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875328, "uuid": "58828d66-c006-4bff-8268-7bcd59a3db2e", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875328, "uuid": "ea9bb5b4-a6da-467c-9912-d1555d93f286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875328, "uuid": "6440a637-c369-40db-99d6-fb50928078d5", "value": "e7495fb200ac5c040bdfeae696d7e3ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ce534d-a74f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675819596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819596, "uuid": "d23db162-4ef4-4b8a-89d9-e3f06e31757a", "comment": "Malware payload (Smoke Loader)", "value": "d7cc5052d4d1f6328deb409e94ff23d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819596, "uuid": "42c1d446-26c4-4a92-bae3-8b2c91913c7a", "comment": "Malware payload (Smoke Loader)", "value": "4dc5b24eb8c139d9b36474253c0e447159a48555410f4e16d7856dc44cf0884b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819596, "uuid": "a03da67f-3a1c-4a6c-95c5-b79717374d03", "comment": "Malware payload (Smoke Loader)", "value": "3f990716aa62103899f968393dfe1e7d6b429262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819596, "uuid": "8a35f38f-72a6-4dad-a84d-c224ce6dac38", "comment": "Malware payload (Smoke Loader)", "value": "b111a95af9b99d6cb7ba208dcaa1dc6be8f5cc61d5de92ca9aae6926606834fecb1348e326efaa0b06b8f92c49237a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819596, "uuid": "838cbbee-16d5-43b3-8a97-0d0639cbf03e", "value": "T15D14DF223A90F072C57728305820DB676BBEBA3152B5CA5B77540B6E4F306C16F3A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819596, "uuid": "da96a752-5493-4c72-88cb-269af10ff255", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819596, "uuid": "35a4d633-507e-42af-8a10-ba76f9875e10", "value": "3072:UGYOIDTRibMslLFfRWbW1a5N3F7x7F/UUUUn0ghZG8ar7oF:UGYbR7sLxEbDlUUUUn0Mwr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819596, "uuid": "1b65c922-c151-4fb7-bcd4-7aace3206568", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819596, "uuid": "cca8ab1e-c2cf-4b73-8dbe-061a8ce776b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819596, "uuid": "6d2ca06e-bf38-4990-a3b7-f942dae5a558", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baf23f1-a7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675862886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862886, "uuid": "6331b2cb-a57a-4964-b3fa-75ac746f4df8", "comment": "Malware payload (Amadey)", "value": "8552bcfe50eeda3db483e4e7282a7f02", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862886, "uuid": "de7520f7-6398-42b3-bf68-886f54919ce1", "comment": "Malware payload (Amadey)", "value": "4dd4bb553b9bbcb86011c97339622f640e82e674946ee5b3fb330e8efca7324b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862886, "uuid": "47190f0e-a954-4147-a91f-77aeab1cae52", "comment": "Malware payload (Amadey)", "value": "5a8264e5ed275850c80a1cc9f0de6e17beafcd4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862886, "uuid": "52d660a2-308d-4d5a-82ff-0636db8c2065", "comment": "Malware payload (Amadey)", "value": "4258ebd77d337ddf9b638bd5f990120c67667f5d44fec13dfb5d55825a1abc3607367084eacd4705595bbc87990390ae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862886, "uuid": "23a6429a-5604-4ec5-a823-18aa18ae4818", "value": "T1E5C4021BEBED8022D4B99B7069F603D319327D911A79876B170F6C5A1C325B4A23633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862886, "uuid": "decff279-9ad4-4b51-bfe1-d67aede08b82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862886, "uuid": "08d09184-02d0-428c-830e-db898ca8e3ac", "value": "12288:5MrLy90OP3LyVq80/wqtY64KEarSa8emgMGPCyWT5Ox:+ytOVIDW66da8emg/bWT5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675862886, "uuid": "c76a010d-7735-4003-9633-bc3210e906bb", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675862886, "uuid": "6a572153-23b8-46a4-a370-4a9b0e1cf37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862886, "uuid": "146047bb-18d3-40b2-a5f3-08af521b571d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c44fa74-a7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675859773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859773, "uuid": "83a66f68-bca5-4be6-9e5f-b077cacd8e7a", "comment": "Malware payload (Mekotio)", "value": "fc8eea8a39e223924788d5563bdb0bd1", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859773, "uuid": "594e6e27-6ff1-4b3a-bfdd-7077824b7167", "comment": "Malware payload (Mekotio)", "value": "4e17f5211efc31a3cabc7f9bda27abe645f4bc0b02d2b2d88e093b056caab2bf", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859773, "uuid": "815b14a7-52b8-47b2-858f-3aaac81d2904", "comment": "Malware payload (Mekotio)", "value": "811429399f763ad939aa420a314c1133668dde18", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859773, "uuid": "90643214-1960-4295-be4f-eadb95790e41", "comment": "Malware payload (Mekotio)", "value": "3a711e5a498afcd43713f5b8c496f35b963215f6afbd7556168f5c2da749d1c727374662e41b6eb52ffeebdebab16b07", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859773, "uuid": "c5c48ab0-1129-4d31-8e75-aa06c34d1a18", "value": "T1E74633ACC7B6993625776C310B347FFEBE52C99EE6751810D3CA2364CD20158A22DB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859773, "uuid": "71370ab0-70de-40af-9b8a-49ff889afbda", "value": "98304:qlSBN3C8Tz+rVLr8DX3C9fj5CvAfrggpcaX8Ai2k1ViEm/eBI3gbgCGraiSk:CSD/0YHCN9CvAfcgpcaX8Apk1VnBI3KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859773, "uuid": "8bc30fe9-59ec-4eed-a578-303c6af323c9", "value": 5423248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859773, "uuid": "1dee85ec-4f61-4178-9903-a717202c7e33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859773, "uuid": "8c4e670a-8701-49ef-8e77-8fdb85e2cd04", "value": "6397f0e156b5a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383c337a-a7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675873107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873107, "uuid": "eba5766b-d662-495a-86f1-6b981e59dfef", "comment": "Malware payload (Amadey)", "value": "788c87cf97f7f632c00ecafa797d7491", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873107, "uuid": "0ef06a51-32fa-4184-b1e8-e5ad373b3412", "comment": "Malware payload (Amadey)", "value": "4e5a49ab1ba48fb5a03c53baece43622f90742d6f2e0c1df14600bdb3e629aa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873107, "uuid": "39659eed-184d-46f1-840d-f87d0e914a4f", "comment": "Malware payload (Amadey)", "value": "747c27126d1c61b8a06e662cce3062877d25f520", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873107, "uuid": "f42b975e-1a0e-4521-82d3-0b2a9a31cbb8", "comment": "Malware payload (Amadey)", "value": "1143b221702193cc5670eca37ebef605e6a11b75b7dc4acabe0622c4dbcd71dbd3d608b728e40446b7f97884a1c7fdc0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873107, "uuid": "f8020715-64cd-4d3b-bc95-43d81e6b2270", "value": "T182C40217B7E89032D8B067B158F606C31B367D51563CD39B278E2E4D69B22B06A3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873107, "uuid": "1625bfe7-39bc-4115-9dc8-e8550e433afd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873107, "uuid": "8a8b1ed5-3486-4e4e-a659-6891656b23d4", "value": "12288:oMrey90epxFWZNFdk4iUq93CK+khPUmN0rmfBdB7:2y9pxFYNFddyCNkVN0Sfd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675873107, "uuid": "45b609d7-b7e7-44a0-ae40-6d51f16a7c9e", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675873107, "uuid": "37653d81-64a3-446b-a9ca-5620307b66b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873107, "uuid": "c850ea4f-9573-43d4-aa2d-c10a97773fea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a787a17-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880896, "uuid": "016080fb-4b22-4620-b0f5-a31c2813b405", "comment": "Malware payload (SnakeKeylogger)", "value": "047185a75d0d58d545a07dee97bb424a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880896, "uuid": "1f1a164f-1ebc-4fde-978f-40a39791d140", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebc65f4877661a0b77c8d75a2d2c3680413e92a5e8307081ab1b41bc7267b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880896, "uuid": "5eb59e73-f141-4e1f-bbf2-aaa842baa46f", "comment": "Malware payload (SnakeKeylogger)", "value": "4a4e7d00aefbbb652e531ffb5138ba0bbc46ebcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880896, "uuid": "380a1617-473c-4387-a2a4-dc3024e94f5d", "comment": "Malware payload (SnakeKeylogger)", "value": "c2274550a152ff6d1fcaad2839057940b55a21681f3c24f91bdbf7e45a44bcb191f3b71d760819325dcc68942abf1a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880896, "uuid": "0acd0487-e64f-4c78-b03d-ddbdf1072ee5", "value": "T18905D09B358485ECCF6E55F6A257844033A4CCBFC518E61A6BC433979ED6BE20C2271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880896, "uuid": "38c9fbe6-48a6-45f3-a8c7-3fec6aeb405b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880896, "uuid": "686718c8-22ab-4322-83eb-ad5824f56976", "value": "12288:JFimar5VFDutOc6duxKLoiba3bHhmuBAqwMiaeZaK1HeDFT9N0iqNCyjtPs9H3Oa:hlAAi9VHet9chxPs9H3/qN6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880896, "uuid": "e731e085-04c0-49a3-9dc2-b5d1d9a353cf", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880896, "uuid": "c4c3c5cc-bb9f-4e28-b654-e1eab2248fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880896, "uuid": "d032aa86-6a8a-4139-9e19-aa58d87ba601", "value": "application_pdf 0071000477553-50042-03022023_pdf (60 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837061d5-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881394, "uuid": "3f6516d3-1f97-40b2-9714-0f012a7fab59", "comment": "Malware payload", "value": "29fad68d4ff9961570ee552b0a1c651b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881394, "uuid": "6c6ffb32-d8c6-4296-a5ab-1e4813598c03", "comment": "Malware payload", "value": "4f0e279aed83104309fa55a22e3a96819beb5f97fe229d9f0e7231c934d4e091", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881394, "uuid": "8dfe3a49-9c75-4a54-ae63-c47f7979e260", "comment": "Malware payload", "value": "57812728eef6c0346b625706453ec667cfd95578", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881394, "uuid": "0023e1a6-a28a-434e-b19c-0846cd3a7d8c", "comment": "Malware payload", "value": "bd6ec277ed802cf93ed5b935e39523a78d930a3e14d623c6d2b7677522268762595e195439ac6678ae2b216fe66f7f92", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881394, "uuid": "947f437f-9624-4c11-854c-31e23e363297", "value": "T1B935E117E172ED2BED27C97CE84F148282069D79AD55CA0D2183732E8A327F42D7ED91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881394, "uuid": "fa8b338a-d5a9-4f5b-b119-64a2529b9309", "value": "24576:VFevFCwcFeRPHKMdykobbV4xxSfR8iemWJw6Cm6:HOHA+PqCobsxSfRz7WJz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881394, "uuid": "ee9ea6dc-1b6e-4dbd-af3f-c85df3646800", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881394, "uuid": "fcb5cfc0-616b-4e2c-8875-9075636d41e4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881394, "uuid": "83e9b981-c386-4655-9ff0-b1e6ea138b16", "value": "Order 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477db96e-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675882152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882152, "uuid": "be0c202b-c8c0-428a-90cd-a23fe74ff23f", "comment": "Malware payload (AgentTesla)", "value": "1fdb0c0400f7771d33226e19783d7b42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882152, "uuid": "9ac908c9-64f2-4638-9b27-0bc35f415ffc", "comment": "Malware payload (AgentTesla)", "value": "4f94afc9355dc8bf4cecef34b1e42063acd18ed7be1e67d6efd8d64d070abeac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882152, "uuid": "ccc54c63-77ae-4e6d-b622-877ec487a8e1", "comment": "Malware payload (AgentTesla)", "value": "bee78ce160480b00be4bb90dbe7d47bab1878abd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882152, "uuid": "adb72d96-c23c-41b0-b665-76c204b753bd", "comment": "Malware payload (AgentTesla)", "value": "462ea9204f414469527fd6bdd65282294fe26701334b20db4e2039f8160fe2a6186d9c2ec3b055b14ae2043b40649d7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882152, "uuid": "5de7eed4-566a-4e3b-9e73-a42d9f31d799", "value": "T159E41206724E4396D45424F8CAEF21B203F66FDAA2B3D2C97D98A7CE4B023A74F45745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882152, "uuid": "a4580b07-c92c-4711-8a8b-de1295d67eef", "value": "12288:8MrGjgh50v859m59yV0hCoLBlXhGIZ8rSpqd/LcCyQbytJLH3Tg8xx3GM:8MrH5A59EoLBjGw8rtDJbytJLH3Bxx3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882152, "uuid": "8c7f8d48-84db-4389-b406-948ee43a9b80", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882152, "uuid": "9e381e2f-84c7-43ee-8d36-4afb31bf1629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882152, "uuid": "ef3d6b88-f046-4607-b6bc-83398f1a2eab", "value": "e-dekont-20230208-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e658e78-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893411, "uuid": "53c82308-6688-4033-abd2-c76af2299a1c", "comment": "Malware payload", "value": "2ffb8bd3cc7f683f5308cda52e003ee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893411, "uuid": "3a8a800b-c82a-46a0-96aa-a8621b0fd08f", "comment": "Malware payload", "value": "501cd8b97f8f05211634cdb5eeb69b195870bd42a9bb40c42b1af2229a8f9b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893411, "uuid": "9c5b40fb-b29b-4787-a979-b4b378269278", "comment": "Malware payload", "value": "927d47569590b0cb4e68ddaa40a4428b0d15c92b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893411, "uuid": "9322345b-80f0-40c7-a585-b4adb4ec36f4", "comment": "Malware payload", "value": "52fe8e209dc1165de3626442da56ef8d00df9fb189a01937657c5cfef9c8e2acb580c55f4cf9ca2b5591272be11ac024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893411, "uuid": "727b9ab3-ecd5-46f8-bf98-b150e51a3710", "value": "T13C95224AFA57DD8AC94C0A71CC92C1BD4822BF08DD230A9336C53F9FFBB4971590A965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893411, "uuid": "3afc0eac-03d8-43ff-aedd-00e2e1c2b3e6", "value": "aabf8916b978563b56675ee42cd8b8ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893411, "uuid": "bd647395-efb1-4f8d-813d-1ba7e1300a21", "value": "49152:0mGgINYoEokhy85cfH5FB9QoJkYagRGPFF:XJEYfokhyucRFB9Qo+3gRqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893411, "uuid": "bf62573e-d699-4fea-a88c-e0de6c31d794", "value": 2011432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893411, "uuid": "00693cdd-d93d-4b29-a135-3fd3bfefddbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893411, "uuid": "e3275738-1cad-4beb-9733-c79bb75564a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9678eee7-a7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675871118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871118, "uuid": "06c1b7b9-12b6-48dd-966e-54f4699b9693", "comment": "Malware payload", "value": "37ea9168b9105a320e7c28d809bb3a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871118, "uuid": "bf9b0bdf-0231-4b5a-8c1d-04d8e5607f08", "comment": "Malware payload", "value": "50a5a555dd26b620a71a4b9b395156484f4a50f24e294d89cb385d8698c07c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871118, "uuid": "ac77cac5-8259-4d11-843d-19d87431dffa", "comment": "Malware payload", "value": "95d46eec4bad215704c0d2291ba8c642445b5073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871118, "uuid": "26c73479-7cd5-4070-a99d-4e9d6c50c7a2", "comment": "Malware payload", "value": "4bc1e25a9c177398cf12b07a673cb0c4bfd126f351dbd23769b456b1938a0672776879ebb2e7fb596bafc9fd2b87acfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871118, "uuid": "c51aa5b5-366f-47f5-af6a-3348f5c40d0f", "value": "T1F67633093FC0D9F7F012A035F1E86AF452DBD9A9CA3188DB2F48513C6E7C195D626B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871118, "uuid": "9ba46676-a1af-4eba-9740-558a23d03523", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871118, "uuid": "55cd7950-6452-437f-bcbf-0b638095f58b", "value": "196608:91OsVeFinwu1JV9zjY+2+4qoXsnZCXaiodz/ne8:3OsXwY594XKMXmfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871118, "uuid": "8470287a-499d-420c-b3c9-90ea40fc3a3e", "value": 7618719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871118, "uuid": "b6d15d46-267d-4101-994b-f393c3d61a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871118, "uuid": "034b145f-a268-43d2-b389-395c1c442d48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d66e50c-a7c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868499, "uuid": "95c4b88a-da2e-44c6-a813-21891fc7af6e", "comment": "Malware payload (AgentTesla)", "value": "a3ff0d40fd8d612850925017ff54b979", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868499, "uuid": "955a8115-6ed4-4824-8724-aef4a07db9e3", "comment": "Malware payload (AgentTesla)", "value": "50bf8569ac5f1739798c9c99f9a4a53818cfbc205d60d0cac0228899d75455a1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868499, "uuid": "71f3e8c2-8d06-48e1-83c9-4f1a79e460d2", "comment": "Malware payload (AgentTesla)", "value": "0ad2ef29b775ec4051274b05e11e71a4d4b6c2f6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868499, "uuid": "df028984-1bc0-4bde-ac2b-6ce6c839f40d", "comment": "Malware payload (AgentTesla)", "value": "00eb21a58615a66cab31eae98f840a8fce4052325431dc874d6acd946b9545c9b3265669c3a589a140c035f9b246614f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868499, "uuid": "fdd4a00a-302c-4bc4-976d-572916dc2292", "value": "T12FB4236A1951B33FA792C8F9B60E9D25A91F388091F61A317510EF4BE2B563BCE050D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868499, "uuid": "6ad8e272-5070-488e-914b-1c47717eda77", "value": "12288:D0q5l3hAkUILXgv6Fmv7S5PzLlWji7/V6I16u9nFs9Ow2ACTZ:o2RE1SZzLlWjwj16u9niDCTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868499, "uuid": "734def8a-1be2-4714-aa1c-1b29f8f3ff3a", "value": 527563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868499, "uuid": "55a44b12-11a2-4fb7-aee4-97aa78b1d429", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868499, "uuid": "83e5916d-1a43-44a8-8866-cee58b8324be", "value": "Swift_Copy.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c82bdd-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881106, "uuid": "aec3f414-7af3-40a6-b05c-3823c4d9c13f", "comment": "Malware payload", "value": "b09a1d56c42fd960baac2caa1b6e2bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881106, "uuid": "c25a60d9-2016-4767-9010-d9f4573a6d43", "comment": "Malware payload", "value": "5141d25397b39dd6fab7c39f7aa1d9bf04ccca1c478575755e95f32edf6ec266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881106, "uuid": "e91edd2e-ae56-4fd3-97db-912a5ecbee50", "comment": "Malware payload", "value": "b742e0255b642ea19b0080dac42dd91b7c728730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881106, "uuid": "5885f48c-da5e-4089-bd0e-5311e5db0130", "comment": "Malware payload", "value": "4705e71ac0a37132b8b19d042639086b8ae1101e9df0b5d59d6bf578cb096e241aa55c79a5e62ef08e138403a9c7e4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881106, "uuid": "5328f0d6-3152-4b1d-94eb-8fc49f37a0f0", "value": "T1847611508503A5C615BB9D3F95F679435C0F139DEFCF8252EA6C93AB1422EB36C1828E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881106, "uuid": "af62b636-96f2-4a5a-9184-4519af180fea", "value": "196608:xmnP/F68J3FxrU93Eq3zPgSnbWOGGY7pq:Y37RjqjPDbWhGYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881106, "uuid": "5bc10bef-8e5a-478f-b891-f87e833f7c44", "value": 7525595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881106, "uuid": "08d897b7-2323-42d2-a428-790018ca9c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881106, "uuid": "2a2eb0ba-5344-4840-8531-2683ea44e8b5", "value": "b09a1d56c42fd960baac2caa1b6e2bee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ee3ad9-a78d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675846011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846011, "uuid": "7700024a-a3fa-4be4-8ffe-e19ec76d3100", "comment": "Malware payload (GCleaner)", "value": "21055218339280f7c97fd686e8ef31f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846011, "uuid": "e0d09a1a-9b81-46f1-8624-1a8d68671416", "comment": "Malware payload (GCleaner)", "value": "519fba324ed87449629f56974d6ca6eaa238669a214f2100c1dfa1de0506e73d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846011, "uuid": "08fe159f-dfbb-4aa4-a1ed-40dbe75a5ee4", "comment": "Malware payload (GCleaner)", "value": "801f8e38b5517049c2b4d55b9ae890e998efbf1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846011, "uuid": "5ffc13f1-afd1-420c-9457-7ed95dff8058", "comment": "Malware payload (GCleaner)", "value": "a5f862a2f301e03b20c180c8a3acb3b7a557a6a1e9ad6944e79292dca8658559f1867a0947ecb90c2c7f1931aadd417e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846011, "uuid": "1dc0547a-d623-4c73-8c3c-32ea8e6b734a", "value": "T18BC5027CB145C46DC290FEB88C3A94E74CD6ADE3E8A4A46270DCBF3F5279185871A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846011, "uuid": "f01cc881-1f14-4d7a-b0c6-aeac7725227f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846011, "uuid": "2c89b9b7-1f72-477b-9e2e-3b9cbde0d62d", "value": "49152:rdHKU2wnV9EslZRYAhFVXf1rYy2CexlFGWal2LCgv2MR:JHK+nV9hPRzVNYy2TFkcv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846011, "uuid": "865be71f-9022-4ee1-b45a-3d7fefc7b1d3", "value": 2682407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846011, "uuid": "cd0e5eb1-cd49-4cc1-850a-c7cd047e70b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846011, "uuid": "290b1cb5-accd-4d95-b737-96fcabfc30be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4549907d-a7f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675888591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888591, "uuid": "b1656960-0b90-4330-afa3-de4fef5dde7b", "comment": "Malware payload", "value": "d8a50e04c633ed47ebb52b5861b4820d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888591, "uuid": "f60090c1-edcc-4472-8b52-9bd2567d92d3", "comment": "Malware payload", "value": "51b1258da64f6287dc05113249ec34b42ef33f6d043df86486e85e7ac94b20ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888591, "uuid": "60dffc0d-edb4-4058-b5fe-c80455b93d33", "comment": "Malware payload", "value": "9346fbf37da5ad5acdb1906b3e57281258868d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888591, "uuid": "ecb0e0ee-8f0b-496b-a971-b9337684e022", "comment": "Malware payload", "value": "213336072eb136befa12ecbdb2f05ac09ed25597114c8851853dae1a41b8d53fbb1072aa3215b101a7adaf1e2fa8126d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888591, "uuid": "df5d8605-4f5d-4ae3-a49f-56ced3cc82c4", "value": "T1DCC40207A6ED5022E8B427B048F703C3163B7F656B34839B274AAE561D721B4B63572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888591, "uuid": "79edae7b-f138-458a-9541-72fff61aab80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888591, "uuid": "f2cb9932-286b-423c-9749-9b957a4faf77", "value": "12288:aMrMy90VRRHUIqZTnpNUMakWO2r/+RVL4oCqqZ:eygRHUIINSLtr/wq3vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675888591, "uuid": "1e9b0d59-1573-40b1-9046-361614d54e1f", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675888591, "uuid": "0952728b-5706-4ec3-8dec-731052a56c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888591, "uuid": "e26072e1-7bf8-4792-92fd-b6b6dab39e17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f452a5bd-a7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Ermac)", "timestamp": 1675871275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871275, "uuid": "e4b82d62-0654-4a66-8894-113bf6e4cfab", "comment": "Malware payload (Ermac)", "value": "36cd2ea94bcf9f9a9959dc4c1c489933", "object_relation": "md5", "Tag": [ { "name": "amplebot", "colour": "#35AECA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871275, "uuid": "469e9129-f6c5-471c-b7f0-98268644e925", "comment": "Malware payload (Ermac)", "value": "51f9c37c3eec0b6f8325aa1c8fe64a0615ab920584042df557426473b1270b40", "object_relation": "sha256", "Tag": [ { "name": "amplebot", "colour": "#35AECA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871275, "uuid": "9f15dadb-5175-4294-b480-4135002cb87d", "comment": "Malware payload (Ermac)", "value": "828c76b5d980c893147bdee72eb3832227aff7f2", "object_relation": "sha1", "Tag": [ { "name": "amplebot", "colour": "#35AECA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871275, "uuid": "30eaac2b-d216-48b6-a0ee-c54281a192ef", "comment": "Malware payload (Ermac)", "value": "aa41b877360fe51f1b1a57528b2bb508d009b2393429de1a2dc0d5faf14a263092f25e6824722e96dece4d2fcaf270c7", "object_relation": "sha3-384", "Tag": [ { "name": "amplebot", "colour": "#35AECA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871275, "uuid": "fc93758d-9157-493f-af9c-a7265c682f05", "value": "T1EB9533AF0BA5CA77C5761571E0E35242A6327A6973A4F5B5D2C8B5CC3DF280C2103A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871275, "uuid": "c8db3917-ddd2-4114-b53d-4d96effdaf52", "value": "49152:+/X7k/o4x1XuIEMYnpn2SL40UFi+xYxpEWWKRFd:+/rMr7XuamB264bFiAopJVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871275, "uuid": "27ebb6c5-ede5-43dc-bc3a-ca29f4fb92ec", "value": 1896652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871275, "uuid": "0bc852e4-3b0a-4ac5-803d-1ce40f767bab", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871275, "uuid": "292b48f9-9834-4309-9e3c-2c20d5790ebd", "value": "51f9c37c3eec0b6f8325aa1c8fe64a0615ab920584042df557426473b1270b40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff67313-a759-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675823835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823835, "uuid": "3ade1a55-b7d6-4a1f-9e7d-71bcf6d7e94a", "comment": "Malware payload (Amadey)", "value": "2b9f59d8403f30bcd9a804e1b608af91", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823835, "uuid": "05d088eb-12a5-42eb-83b2-9f81c643f889", "comment": "Malware payload (Amadey)", "value": "5212cfa376b33d9be6e37f98e9c5e35b0ae60d54850c9e664b304ee7bd9816d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823835, "uuid": "ded1b3d4-46f6-4b86-ad15-9e2d1544d45c", "comment": "Malware payload (Amadey)", "value": "a3f26e610478503e09b22814ba7f3b6e0f672d62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823835, "uuid": "1ac06c2a-f63e-401e-a6d7-8dff80548115", "comment": "Malware payload (Amadey)", "value": "6f6f2e0b0e4a8736798f9961950a7c6abe9895a35eac34ef0964e5d409bc5a04b436d9d3f11f2320dddfcae2dd0c08ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823835, "uuid": "15ea2c4c-6747-4c03-bada-822833d0e858", "value": "T144B4021BF7E88022EC752B7019F60383063ABEA15B74439B274E7D5A1D712B4A53636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823835, "uuid": "aa5d1a4f-b803-49ce-97dc-36ba06ee2915", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823835, "uuid": "707cf822-a29a-4ea3-8dfa-200c4eb582a0", "value": "12288:yMrny90VTzbqu0o+hpcPVcoZaajjN5MCq6AzZ:xyObGokOeoUajTq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823835, "uuid": "1b9bc258-e2ca-4940-9994-9825ae58546f", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823835, "uuid": "e495a9c5-dd3a-41ca-81f4-b03fa8cb8b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823835, "uuid": "13b92162-bfea-4700-a45a-6ee9794da9fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d08d52-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675859009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859009, "uuid": "f6b1688b-e1e8-4108-86f0-5f203212af4c", "comment": "Malware payload (Vjw0rm)", "value": "2741962d66669cd7ab60aaa77068c5c4", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859009, "uuid": "143460f8-ce21-4259-8a76-bb02fddf1fc5", "comment": "Malware payload (Vjw0rm)", "value": "524c411868be9769efa1197add86395053157040e26310efa2648c4b0f8bc50d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859009, "uuid": "113c2d63-492d-4f6a-8e13-18f1092ed571", "comment": "Malware payload (Vjw0rm)", "value": "3733140484d2cafe4db60966d008b8c5aa004b7a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859009, "uuid": "65037ebc-a3ba-445c-bda1-7a03b5cfd816", "comment": "Malware payload (Vjw0rm)", "value": "d00893a0a3cec4be6f3b57a9d853e5fd8cb0692a6adcc24915c50816cd443e97560f22b5f687b8bd8729adcffba12bc1", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859009, "uuid": "66d5281e-e627-4b74-9a1d-7b87c28c7b78", "value": "T1C8568F7B7CCA5634FBC5FC7A0CB68A2E00E21C524029955697767C27E13BE7097F029A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859009, "uuid": "2c1c5569-36d5-4ed3-ad39-154b6f420cb6", "value": "12288:ob9Xn7Mu3qI70c9viIRub9Xn7Mu3qI70c9viIRR:oJX7MA0c9vxkJX7MA0c9vxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859009, "uuid": "9ee733ac-6e16-47ac-9d17-0d5361171a00", "value": 6311936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859009, "uuid": "8d586499-0aca-4240-afc2-fec1bcd2d37a", "value": "application/x-virtualbox-vhd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859009, "uuid": "91d6e629-b4f2-4c46-a10e-667830926762", "value": "1ZWAJSAR001.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53bc917-a776-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675836461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836461, "uuid": "9a9a0693-75fe-4891-877b-5dcb922020f3", "comment": "Malware payload (Amadey)", "value": "0abbaacb833cfd554f68a8a1ca7ac2d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836461, "uuid": "d3bb77f8-ef07-455b-b8bf-6db8de12c1c6", "comment": "Malware payload (Amadey)", "value": "52d558aa45bfecfc23a55a2e21af6e10e234d73dc4bbad6acb4bc42c2f4ebdde", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836461, "uuid": "caba461f-2aad-41d0-bcde-f6db976aeb11", "comment": "Malware payload (Amadey)", "value": "19e7a401913e8c21dc3468ed093c222bc9b915b0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836461, "uuid": "c442a245-226c-44e7-80c6-6ac12dcaaa19", "comment": "Malware payload (Amadey)", "value": "8180f257cdad27f1f9535931df3dccc47a2800c58f93c3abed119dcb558f1b641cbe19eb097e793276fdf580a3c0ad8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836461, "uuid": "36d99dc8-ae3e-44e4-8237-f422bbe549b2", "value": "T19DC40207A3F98023E8B467701CF303C30A367EB16A34479B564F6E5A58722B4B535B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836461, "uuid": "a6a9d648-0863-42ea-a747-db353f01f7ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836461, "uuid": "931bc9e2-4858-4d02-a9e8-c2b2e84d87c8", "value": "12288:5Mrqy903YdRxoesbU3DbWVLbAJBOrLMyYxWbG/:3y0JODKJQsrLtYUG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675836461, "uuid": "cdf47897-ebab-4958-8606-5c2ade7d4131", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675836461, "uuid": "7ee6a056-bea1-4a62-959a-f0a999b456cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836461, "uuid": "c9ea3daf-22ec-4893-bc07-9179b5633284", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9796fa97-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675852222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852222, "uuid": "38e7d3a7-7f35-468d-a3d3-5c2c905f98bc", "comment": "Malware payload (AveMariaRAT)", "value": "d375e0d72434c403eff16b569c5dd970", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852222, "uuid": "20ef0c22-443b-4bd1-9bc6-6c88e0df7a15", "comment": "Malware payload (AveMariaRAT)", "value": "52de5670fe9b0f21fd6dbc8e5f5ef444305599651769de418e6c4aa0ab83d220", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852222, "uuid": "0ec84005-2515-4d10-9d19-ce46b3788cd0", "comment": "Malware payload (AveMariaRAT)", "value": "ae5bdd799c39758738420babfd29f459bea5b3c3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852222, "uuid": "d11a18ce-5aa9-4724-9208-493cfa7f2141", "comment": "Malware payload (AveMariaRAT)", "value": "e759943cb5e2b98a9d67e746ab295d50a5dc184c208182ef6cc08b049046e050b052a7172eb5c1e87b9b04359e518f47", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852222, "uuid": "fdd5f77d-b171-4026-9d2f-7e7e7ce4f7e9", "value": "T12A25F152E118EDC0E51506BDC873DAF0126AAE7AD460DDCB2AD67DAA7D323833052DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852222, "uuid": "f8e6e201-0d9f-43f8-bb85-8cc33e8f6adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852222, "uuid": "2f9d7ec7-fb29-413d-bfb0-23fbecca8f48", "value": "24576:C1bgzPGhgzfY54GED1yGWTfS8uwMYe/V3:CZyPyywSGEByGG8wMYe/V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852222, "uuid": "d2160cb5-3fb8-4234-9ad5-effc9e0154df", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852222, "uuid": "2f9b7486-7c99-4f8e-813d-d8a975db572b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852222, "uuid": "fc83f0d8-4581-4bcb-acdf-048577d55794", "value": "Remittance Advicecpp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb06fecc-a806-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675898264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898264, "uuid": "a9ffae81-6bcc-46f9-b97a-835003da32b8", "comment": "Malware payload (AgentTesla)", "value": "4ea51d2a32944cd50b5eb030f09ab6fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898264, "uuid": "32bc6f8c-80d4-44a5-9cf7-698d3b77aa87", "comment": "Malware payload (AgentTesla)", "value": "53245d962b781d4ecd80a1b763d94c006fbb4c3863629e515c290320a6d30374", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898264, "uuid": "18752115-40f6-425d-9f41-e378501eb77e", "comment": "Malware payload (AgentTesla)", "value": "196e778cd7cebaa28b03de1f6e6874accd618961", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898264, "uuid": "e1f7f2c2-73e4-4b03-886d-ddc8a3fff0a3", "comment": "Malware payload (AgentTesla)", "value": "802d0f810a0e2737f511bcec43dd30689d9a3900ff16d60c26ee359dece24a9eccd4d9cf250f0215f1e251c64a6c5a23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898264, "uuid": "a886e93a-3192-45a6-949a-ba5154c486a6", "value": "T16205183E297A67D2D038FAB546E04520B3DD9787B303C998FDE12AC4CF815856ECA25D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898264, "uuid": "929c77c4-a062-4461-8954-ad966e4edaaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898264, "uuid": "222bb795-f1ad-4972-9302-0fd69a579afa", "value": "24576:B2m9Nhh6H7MTyPdLX2tuCAe/ZXOOxltKwJuLn5wCM8v:Mm9NhhCKrJWwCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675898264, "uuid": "4a05b447-8c63-430c-96c2-fdb240e8fc3e", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675898264, "uuid": "b0485802-2477-4fdf-9e0a-f7dab32ba58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898264, "uuid": "1e2e898a-0028-458a-ab92-5d9d2c43364f", "value": "Company Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c09c75-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675881421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881421, "uuid": "42bb3f80-2a82-4eb8-9d4c-efd680a5ed95", "comment": "Malware payload (Loki)", "value": "6ee345e07d729dc67be58d9f4d714cd7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881421, "uuid": "d46e1bc5-d1a2-4063-a2ca-cd4aa3c870cb", "comment": "Malware payload (Loki)", "value": "53560a2f4539618ffbc4951d192f9db8c9d196792cfd790489ebd1c107abba2f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881421, "uuid": "119274ed-66dd-4670-9083-cf8d95a3d667", "comment": "Malware payload (Loki)", "value": "e3048b4cb23be971dc02532a26a66f891ec50744", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881421, "uuid": "79e4ea0b-7503-4be9-97fb-c76abe73488c", "comment": "Malware payload (Loki)", "value": "70bc929d407ed5f12f1c1161d6e9efe176b1d42fb7d207869e3cde0ab45ea1a0918112b1b733a7a8fde5f1dbbb2a6f7e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881421, "uuid": "18c80902-5df7-4440-b7d8-1331fcd31e3c", "value": "T1C0E4E00BE1BAFC2BE456C73C98AE426245036C7B5993C60E10C1B62F5B73B615DFCA58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881421, "uuid": "2b23f7fc-74d2-4331-9111-14ca6295a9e3", "value": "12288:JzBYuizBZf8cAf7/A/4dU+6ZI7vsfXXXXXXXXXXXXUXXXXXXXXXXXXXXXX6:pBriB+ckA/2U+T7+XXXXXXXXXXXXUXX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881421, "uuid": "55583bbf-c973-42c3-9d22-4f7aa08440d5", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881421, "uuid": "9b42203f-16e3-4d61-8ebb-fa967c1b88f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881421, "uuid": "748ec199-da44-40e9-83b7-3b10f5dcb918", "value": "shipping documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b17ea5-a789-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675844301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844301, "uuid": "450afbb7-40d5-4e99-a91a-4e68a9a0de1c", "comment": "Malware payload (RedLineStealer)", "value": "ec7ff2b43f3c63405ccf42e4928cf358", "object_relation": "md5", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "pw Magical2013", "colour": "#2B7016", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844301, "uuid": "6bb92176-5b53-4dfa-b9cf-48c8920c6c62", "comment": "Malware payload (RedLineStealer)", "value": "53755003a6c6c0d989b3d33d53ec36221431f0d60899b2001a2db80cb072728a", "object_relation": "sha256", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "pw Magical2013", "colour": "#2B7016", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844301, "uuid": "fe59e052-6ff3-42f5-9953-dafe030c270e", "comment": "Malware payload (RedLineStealer)", "value": "65e571041a7e04594a424229193f0417d4301cff", "object_relation": "sha1", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "pw Magical2013", "colour": "#2B7016", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844301, "uuid": "032641a0-074f-4aef-a443-e713e6bb7980", "comment": "Malware payload (RedLineStealer)", "value": "b4c87744a326a9e4e8eaa182484f32ca18046d54d0b9c3a07884fa213138622ba278252a1649322cefc007a3a0f9a145", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-199-206", "colour": "#4E7C48", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MagicalWorld", "colour": "#A93DFE", "exportable": true, "hide_tag": false }, { "name": "pw Magical2013", "colour": "#2B7016", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844301, "uuid": "4e8a2458-4b96-44af-af6b-c38c7af085b7", "value": "T1616733BCD5EE2C3BFB6A93311C5BCE452B09091A86D6A2D3380711C468E24D5F357AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844301, "uuid": "5b1b30b9-9d83-427c-a7ed-cc81f2b6bf95", "value": "786432:J8SKUtu9Il2ZBqvl6kFmCajH63i+1e84uKZ6WI2Gi:+SRu9AcpHjUre8Rlfji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844301, "uuid": "2102f95e-2736-49d6-9f9d-963724a725a5", "value": 32532669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844301, "uuid": "4169a5c7-81a0-4929-9af4-e4050b2922a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844301, "uuid": "31df3ceb-02b5-49e1-b44b-a42402ebd62c", "value": "Magical World (BETA).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8fca3f-a797-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675850432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850432, "uuid": "1dff0714-079a-4591-b8c8-0630d026af92", "comment": "Malware payload (RecordBreaker)", "value": "db877af32192fdc5491af19fd5e30983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850432, "uuid": "f6639bde-c4d0-48ef-a9ad-77b8fbbc850b", "comment": "Malware payload (RecordBreaker)", "value": "537e6f527b72091899abad3d3942be5e36624bf4078d5cfde26974e5b68ac156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850432, "uuid": "bac09039-c0e0-4920-a578-a3b4430ad0cc", "comment": "Malware payload (RecordBreaker)", "value": "058787ff446ca75ccdaeb592dd68678d4f01553f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850432, "uuid": "2799a725-92ae-4e03-8dba-9858c573d5a2", "comment": "Malware payload (RecordBreaker)", "value": "2e11336e8fbf15e206fe52e441806139b5ae893ddaa55e73bdb99624b69f04329cac523bd0d445459492e821248589eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850432, "uuid": "a06f01eb-98f6-433d-bad9-abc47e8d3bac", "value": "T1CD643B53A3D07C48E925CB73DE1EC6E8F60DF5A0EE4B77693218AA1F18B0172C667611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850432, "uuid": "1a31a2aa-f054-462d-acbd-6d9545f913e7", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850432, "uuid": "6adaa43a-4575-4037-8538-0fe824384ec2", "value": "3072:kw3qnOAyXR5Px84LC1X63VMWB6bo1Xb1sGgMCIE0j8hWByUAl1FiuGBW:ku6+PKwC1X63VsbwXbGShRj0WUj1GI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850432, "uuid": "b5a4c3d7-9156-4e3c-8b63-39cc62a93528", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850432, "uuid": "3efc7eb6-a1b3-4555-bd3b-296d418e10f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850432, "uuid": "64e3f9f4-d243-4d5b-80fe-10c28c603347", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ccf194-a7a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675857809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857809, "uuid": "5210cc63-ed8d-46f1-be3c-45951124fe19", "comment": "Malware payload (Smoke Loader)", "value": "1fc118ac623b5b71471329c5e15e206f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857809, "uuid": "61a42ea1-e045-46ef-a4b3-2ddedfbde15e", "comment": "Malware payload (Smoke Loader)", "value": "53c615bec4fc144aa5e2746c1e7e32af638a296f6d7951c1e26d4b2cc04db3c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857809, "uuid": "adfdb3e9-73fb-4f64-8ddc-766e2af53a4c", "comment": "Malware payload (Smoke Loader)", "value": "1e6db970ff4d5714f586a71a91997b6dfb360266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675857809, "uuid": "976991f3-0b42-48ff-a46b-c638da8965e0", "comment": "Malware payload (Smoke Loader)", "value": "f1dc7eac96c91f4ddfdb459674dfed17a25b5d4915f74ee3cc48027ad60ed7efba8457bdf1bf7a20e4a7ff6a35f3c334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857809, "uuid": "fa0f7f2b-fdbb-4160-a254-91af30e02277", "value": "T1B7644B53A7E17C48D925CB33DE1EC6E8F60DF690EE4A77693218AE5F18B0072C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857809, "uuid": "e2387c2c-71d0-476b-8bd7-639bd873740c", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857809, "uuid": "bbc75fbc-bd65-4635-b533-90c7d46dc1d2", "value": "3072:XwBqeb7GtRlGCHaq3HDDb5gaP8IyT7b220iM10hegpWByUAl1VLcBWnU:XURQGC6qXeIybh/thfWUjiIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675857809, "uuid": "4ff34a6a-6090-46b4-8673-de36cd8bb62e", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675857809, "uuid": "07a34e83-4e6b-48cb-a80e-154d2ed944f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675857809, "uuid": "92f8f6de-e55f-47ba-8ee5-60a7abb134ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ef1c00-a7b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675863978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863978, "uuid": "4b1df109-b9da-4db9-8b9e-08e48d510fc2", "comment": "Malware payload", "value": "311d9c059dafadcba7b646ed0332e51d", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863978, "uuid": "e86923ec-da65-402c-84ff-d6e0eacea2d7", "comment": "Malware payload", "value": "53e5f7f235237487facd71d28d0cc2911bb74917addd39c777b8ece71a679a00", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863978, "uuid": "ad1f059b-ec15-4709-90a4-031385f2d028", "comment": "Malware payload", "value": "b475b50cad96e05be5f99e614692753ff42bbcca", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863978, "uuid": "ebc5adac-8d6a-4215-8112-86d690389173", "comment": "Malware payload", "value": "8ba570e68dc5946892883993564fe6b7a29fcf1c6f2cc65321b9d5e144fbb59d5ca0afa5e46c9fd2a1bdb8e11987fd26", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863978, "uuid": "2bc5fdf3-3403-428c-b81e-f892fcee21c6", "value": "T1E4930889B2D8B4D447A32BB7BB3F31D6F0D608D21888856AE1C4F82C7DB556BD5B0835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863978, "uuid": "c6a9d236-2b1e-4845-85b0-940fbc510979", "value": "1536:SIH9l9bfB3+5DUVAfYkK/w0cKP+xnMyIasokmwKeoi2S:SIH7SJY//YBkmwKe/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863978, "uuid": "bcba1804-94f7-4b71-8801-5bd4bd55984f", "value": 90242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863978, "uuid": "c15afc1d-2425-460f-a3e2-4f19fae63c0e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863978, "uuid": "d6c4b4a2-241c-4c7e-a6b1-5717697d2650", "value": "4a824a22f363640c90b7da1c8fea8851.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2dfb42-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675859130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859130, "uuid": "d7345c76-511e-4bb4-ac42-ed2922fb10d6", "comment": "Malware payload", "value": "5c08db3e9a0266fa2ba5f492bd6799d3", "object_relation": "md5", "Tag": [ { "name": "wim", "colour": "#15AE30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859130, "uuid": "3caa57ab-892b-437a-b547-58ee75cfa610", "comment": "Malware payload", "value": "53f8abc41b1eb356a2e7fc8273adde01be3cb2eb4245f68488120532ce949888", "object_relation": "sha256", "Tag": [ { "name": "wim", "colour": "#15AE30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859130, "uuid": "0eaaee06-fc42-48b6-bb9c-cea77d34e6c9", "comment": "Malware payload", "value": "72f254d04d6afb312246b3615ef20ce7d227c3c5", "object_relation": "sha1", "Tag": [ { "name": "wim", "colour": "#15AE30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859130, "uuid": "5a94a215-c12f-4908-b647-50e09a451c8d", "comment": "Malware payload", "value": "9da465ce96204ead2eeba78df945fe66d9ce1bdaf633448d352e3bddd826679879eb4bb33de0a27a2775975e821c84b9", "object_relation": "sha3-384", "Tag": [ { "name": "wim", "colour": "#15AE30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859130, "uuid": "2fdc696e-4572-4574-b602-fc13f7adb679", "value": "T1BDE4E33E1DB622E2E1B8FB6156E28420F59C8092730FC959DDEADBC07F015426ECE65D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859130, "uuid": "ca9c5b34-8e79-471b-967e-07cd08a87b76", "value": "12288:pPb+HT0qE8S6S7ztLHKNu+A+/1bSeBif3BBDviw0r5q6xof7DSHn4/vCqN7CcpxN:Rb8vOztLHKNu+A+/1bS933v0o6HcCwCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859130, "uuid": "17fb2ed8-f4de-4b85-96c3-111d7768e9f3", "value": 658198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859130, "uuid": "07783870-2f00-4fc5-902e-82060e9826a1", "value": "application/x-ms-wim", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859130, "uuid": "b4eddec1-6e02-4c08-949f-c248f2cf91c3", "value": "Credit note with stamp.wim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8240a961-a794-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675849180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849180, "uuid": "4034ad11-214a-4032-a3fa-e3de8efe6c35", "comment": "Malware payload (Amadey)", "value": "30f1986a9a80f15ab7c68e68528fc8ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849180, "uuid": "718a93a7-4335-49cc-b881-57fe4467c8b2", "comment": "Malware payload (Amadey)", "value": "540432b865a7515a982e9972499ad566be4987d6993edae3d998e793d505ee51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849180, "uuid": "97c2303c-a3db-452a-9d39-0618831ce0b9", "comment": "Malware payload (Amadey)", "value": "7bb2e204bc738059d1e8d40b75c284bb7aa9b3c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849180, "uuid": "1f561821-4c5a-4aa7-b146-50c301ae80d2", "comment": "Malware payload (Amadey)", "value": "c4e170b6938195716650aeabb5f830bc25c1d612aeb39e0d9bc74c0794b506e8b048672b603895a1d2f3537a3e7b1116", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849180, "uuid": "9c3b72cb-ca02-4b6e-a112-cf8f3b44bd94", "value": "T12AC4124BE6ED9032E872577069FB02D30739BE905639425B364BAC9D1D732A4E33136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849180, "uuid": "f697eb6e-4320-4a45-9be9-ec5d7b6b37ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849180, "uuid": "3ea751f4-bd09-4c3c-af47-b850c6ea0927", "value": "12288:CMrky90n7eb68N2goJR5W1RqDe4uz8kEqtDaXnn6MHOR7:eyd9oJW1I7SXOXVHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675849180, "uuid": "9cbc5e6b-ce75-439a-9d70-70fb07c4b2c7", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675849180, "uuid": "e49d8f15-fd94-4628-ac47-7e9de9fb9410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849180, "uuid": "7957c8b6-ed94-4caf-85aa-b4943eb852e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5645b116-a78c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675845670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845670, "uuid": "315491e3-c72e-4540-90be-69d3b32956f6", "comment": "Malware payload", "value": "3779d927c6ebc0f266015ffe541efb2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845670, "uuid": "60387cd7-e07b-4575-94ea-cef4bb305a50", "comment": "Malware payload", "value": "547d0ae64605fbc638fb42df51d55284b757d5ee8c65a439cbd21cd6f0cebecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845670, "uuid": "7993bd81-f93c-4330-856e-191997b3bf11", "comment": "Malware payload", "value": "766beba030820d70279ccd9a12281c0b6eacfaa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845670, "uuid": "791530cc-0eea-4c57-b883-82a10383e5d7", "comment": "Malware payload", "value": "278d4a2e2a61f12cf42006f2eab20728659b30a639e875866194959364b6efda81062fa24d753109a596cb6a59d75cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845670, "uuid": "15a4b6a8-ff84-4388-88c8-5777d23eb3e5", "value": "T1461623053AD6C4F3D4B60B321E751F395E7A3DA07FE4969B1BC937188A310C2DE26662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845670, "uuid": "8228aa29-8df6-4264-bf3d-b64ce9e8bec0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845670, "uuid": "829299e7-8d70-41c9-b22d-bff65751d86c", "value": "98304:iDtkgzz/0lMscdO2GCgu+9c2cdI+GUQ/QaLTt:+tkir0Sssgu+KdIoQrL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845670, "uuid": "28c8b210-d76b-45c6-89a5-18ccbb139a93", "value": 4024328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845670, "uuid": "ac98b3f1-c5de-40fb-b177-85f8f809006c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845670, "uuid": "0f405d5e-df70-43cb-a10b-b489218452e6", "value": "DM84280HF1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4131f93e-a787-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675843487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843487, "uuid": "56dc704b-475f-4f89-a5b7-1fe0e29bd6d3", "comment": "Malware payload (CoinMiner)", "value": "b8db3db77406740078a3e972fb50cd6a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843487, "uuid": "be9c77d2-70b7-4f72-bed6-e95ce409ba3b", "comment": "Malware payload (CoinMiner)", "value": "54b4c5868c32023f55772627d94c108b016cfd450f922c3f790013b6f18f8762", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843487, "uuid": "5ce60619-d56f-497f-a595-307d5746a987", "comment": "Malware payload (CoinMiner)", "value": "f500b41f5ef6579cd2af508e26af8407dec46f31", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843487, "uuid": "fd4d1126-e75b-4e6d-ada9-a6abb5587f2d", "comment": "Malware payload (CoinMiner)", "value": "e1ec3e369ebc3ed1c3ff5eb9a297b3b64638d7e1bc4791c93e4d5df4627d4b3adf06a2cd9b6ea97cfa9124f0d4895516", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843487, "uuid": "18562071-0ec4-4f9d-a013-a89476d26674", "value": "T1FD95AD04B27DD415F295AB34FB657EEC3810BD1979190A8F27C8B2CB97F6772490BA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843487, "uuid": "3e00fd77-33b8-4882-a18c-bc2c31b8b572", "value": "dd040fc429cdddf0f67d47c7004862da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843487, "uuid": "aac4b151-1c3c-4cc5-a7b4-813b3ce332b0", "value": "49152:V/wMJYtEt6tcpTBbnAG7XNQCK6usB0TZ:V/Nyo62pRhi+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843487, "uuid": "8618bada-1e70-4301-a476-b75315c76ab9", "value": 2008736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843487, "uuid": "0e4429b2-a932-4cd7-ab0a-a3a54a5c0998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843487, "uuid": "712d4a82-d0ce-4ce6-a1fb-d62165a0e733", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55229322-a790-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1675847386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847386, "uuid": "83c3b129-54c4-4cfb-865a-7c8df175a410", "comment": "Malware payload (a310Logger)", "value": "d47eede9ff12be4f4f000481c246834d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847386, "uuid": "0a618036-58b4-4a92-8f56-ac9ebff7d52c", "comment": "Malware payload (a310Logger)", "value": "551d58c1d672e0288b0a38347dadd9913578670e44548cb929c8956a0f7e2939", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847386, "uuid": "fe7c140d-6b9a-40a1-ae00-9faeff82a8f8", "comment": "Malware payload (a310Logger)", "value": "0c3817118e17d251b342bbae64fef779f518a9ed", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847386, "uuid": "89b21cda-8cf7-4ae5-a4e3-67694c21b0f7", "comment": "Malware payload (a310Logger)", "value": "2b6009675effda0cb2729b28801e15151f12c89824e81314b6d397cac2cc9fb221f2fee2333b0d10d9391fc441aa4ca7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847386, "uuid": "4c4940f9-4462-4054-96e4-86efed3ff088", "value": "T1F815AD9377F19863F6C711A510283B8D2FE07103BE55E2579B3B79C09B05AFBB298252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847386, "uuid": "6e1243f4-f9e3-4e87-8bbd-26d6da829f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847386, "uuid": "974f1b0b-a134-466b-91c7-1bc2e8de55a7", "value": "24576:UHwiSB0YYNohjRPPjuv80G7XwJQqG4yPa:q0VjRTuv80G0JV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675847386, "uuid": "e013d031-d2db-4a32-a1e0-67e8785da013", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675847386, "uuid": "ea849e2a-5495-4e45-95c5-80e6faf3e27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847386, "uuid": "10e973c4-a90e-418c-949e-2de68a8978c1", "value": "PAGO-29840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7277238-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675881024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881024, "uuid": "f4128dc2-6431-4e3c-af73-19e13125250e", "comment": "Malware payload (Smoke Loader)", "value": "4e79db1f9fec8f667d3b526591b1a541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881024, "uuid": "d238d47c-a074-41c2-9c6c-565754125301", "comment": "Malware payload (Smoke Loader)", "value": "552d8530695a08b1b85478236d4f539654341f5d76fc157435aae916b5560190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881024, "uuid": "3a33f604-eb21-4fa2-926f-fdaffc04c777", "comment": "Malware payload (Smoke Loader)", "value": "078ba412588d03cb415f0a212549b026be13d164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881024, "uuid": "23c0b511-02d6-45d1-a920-38f69a443ba9", "comment": "Malware payload (Smoke Loader)", "value": "7cae4a746ca16221dff2234c56064acdb40d8d7c336497174c7ad07c10da86eb390a0136eeaa20ca70f3e704d939ee6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881024, "uuid": "889e176d-df01-4c24-96a2-58dd7b1b932c", "value": "T11F641803D2E27C84F9658B769E1FFBE8765DF9608E4AB765321CDA2B12F0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881024, "uuid": "428a0a21-67ee-449d-b335-275bb5086b18", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881024, "uuid": "ae6274fa-9395-4808-9484-dc39f3361418", "value": "3072:cPgPTqzvzxR9SNK6yYiNIsfp+S/iUvnMZiAZksWQDiuLpJ38vJ:coi5Sg6lm1akMcAZBLiqJ38vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881024, "uuid": "d1d08122-aae4-4e10-a078-9c7e86a9b69a", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881024, "uuid": "074fa884-d53f-4f6c-9f72-aa0d2d17fa45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881024, "uuid": "3a273a01-c804-4fe0-b9a6-5197d6a79b85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690b081b-a7a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675856439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856439, "uuid": "8a863df3-8806-4de9-aea7-81f53936b14f", "comment": "Malware payload (Formbook)", "value": "714b07a7853bbd40899905e1eed3ef9c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856439, "uuid": "4dcadb3d-a142-4a3b-a59d-59e8a719f4bb", "comment": "Malware payload (Formbook)", "value": "553e1b3e0681bff4b2e85cefba1ea7ed48c5161c682f8fe3e5346a266b2b2c7d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856439, "uuid": "e5693110-ea87-4ede-a9f4-ca445d989cca", "comment": "Malware payload (Formbook)", "value": "3a25e3b33e3447ba45e08c33d9f66294f32d75eb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856439, "uuid": "26eccd0e-e853-49b4-bcab-e179a6edd5dc", "comment": "Malware payload (Formbook)", "value": "fd4f1832afe042b7b10fe4d033af829e7559359a4c23ac7c9227ed743bf4fd48fe5b83a7e8a540418d7b9cf5ed979ea5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856439, "uuid": "784d378f-a013-4d56-a29c-9af05fe8470e", "value": "T13F0533D12AAB3D69B906C280EFE748440CE42DCB47A75CDBE1FE7A7590357C71109A2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856439, "uuid": "280f45a1-2801-4eef-81d1-56b12e84f96a", "value": "24576:OC6SVdP6AD0Z5PiO+rW/HqAcpeaCywDUVLbP76Z:OCf99reqxdz9fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856439, "uuid": "42ca0504-a83d-49a3-b3d5-9adbb28f9fd1", "value": 812023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856439, "uuid": "e885d0cd-d0ee-4330-9a6f-22fa20b65e34", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856439, "uuid": "2971db82-16a6-4ad7-85d1-b4c3e328eba3", "value": "REVISED PURCHASE ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018a902f-a7b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675861849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861849, "uuid": "515e5a15-aa55-48be-b2a1-92a497fa0839", "comment": "Malware payload (Smoke Loader)", "value": "2307ef97cdda9b4b70d0f62914428349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861849, "uuid": "202ecff5-4565-432a-84ca-778491a3c26d", "comment": "Malware payload (Smoke Loader)", "value": "555e449bb5265260b6f8a4b62c0c5527784a6b356d55f296e04f1f46d0d40978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861849, "uuid": "4c46c618-913d-417f-bca9-cc836ee14eb1", "comment": "Malware payload (Smoke Loader)", "value": "ae179b98df8b0859caa712b0484e4baf6bbfbe1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861849, "uuid": "8706d3a3-54f2-4bbf-8cd5-832813036c86", "comment": "Malware payload (Smoke Loader)", "value": "87e7fe4ed32c2cd6bc6d35e91c473ec8b8fff2a246e15d259d2571e8dee896a620d00b36416a02455a8c8eabed72353c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861849, "uuid": "10949f90-0a12-415f-87bc-3ff79f6dfb73", "value": "T1D46429C397D2FC40EA918A73DE1ECAF8761DB9908F5E3776921AAA1B14710B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861849, "uuid": "7d932a0a-17ea-42bf-9256-a269dd107fd3", "value": "2f5b7fed6dc1f658f0b63563ffdd4c3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861849, "uuid": "64f17cf7-74fd-436a-a1d6-87685c293a10", "value": "3072:hwdaMe3Z+B7trr8ZOSCnognHAwiJsajW/xB8gvl6RLStKRxhUwNeio:hWaMaytsZODogngwii/8gvl6gtKBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675861849, "uuid": "2f5e2043-d2d7-497b-9688-690c818c0d60", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675861849, "uuid": "dbc10fe8-e46e-409b-8d59-f9a21d5b57f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861849, "uuid": "23ccad3f-353d-405c-a1e9-6d0c5062a2cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518a4bfe-a765-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675828911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828911, "uuid": "418172b7-8f2d-460d-8254-43ae3d260c10", "comment": "Malware payload (GCleaner)", "value": "ef1944768092835591efe26f71687657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828911, "uuid": "8627f7c0-2592-4e7b-ac2f-10b703ad1ed6", "comment": "Malware payload (GCleaner)", "value": "5584bc595763df8f14dbc559c29f6b38256ffaa7cb86f93f2cf29ff40aeb60de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828911, "uuid": "cb53bd7f-9db7-46aa-8abb-846a0a31779e", "comment": "Malware payload (GCleaner)", "value": "95cbcaf305c77e4de56452404663c3e52f52a631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828911, "uuid": "b0d00ea9-6d9b-4860-be38-0817864260e4", "comment": "Malware payload (GCleaner)", "value": "a355fd2100c8b8484ca620a1c9ff428d577efa88fab2bab1e5f922d74d101c002530d5a3a6f6440c431d58db9e9b03a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828911, "uuid": "9f532868-bfc3-43cf-ab61-68ef5dfad143", "value": "T191C5127D7215C8ADC2D0BEB48C3A98E75CD66DE3E9E4A42270CC7F3F91B9188561A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828911, "uuid": "a33e27a0-f1b1-4192-bfa3-e97b6201afdd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828911, "uuid": "1b6b636f-9329-4104-b85a-e62f47e6e7cb", "value": "49152:pEHqAlmhKJZbLiiQRfG8Rar0weJH0WGVJbEG5XSsonIJRlfbCF9beBLCgv2MR:6HqAzLrQfjar0weJqVJYG5XjEqlWFJeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675828911, "uuid": "275e0582-78dc-4934-9b3e-311af7bd136d", "value": 2716359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675828911, "uuid": "b0131527-5ccc-4a60-ba0c-f6e1dd9020b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828911, "uuid": "702cd6af-c73b-4277-957c-b2f4a513afca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997be4d0-a7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675870693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870693, "uuid": "cde5dc89-aa1e-4346-8c95-08f55db14a84", "comment": "Malware payload (Tofsee)", "value": "351f944c16d40d0b9b79efaccd53dee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870693, "uuid": "9d63eef6-d208-4a49-b084-01774f7d154f", "comment": "Malware payload (Tofsee)", "value": "55a590080a2af4358961bde278a0ef1a16d97fbba120413ea9960a4709f84a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870693, "uuid": "eb4d7391-4bd2-4d9d-b607-1bac516244ac", "comment": "Malware payload (Tofsee)", "value": "4262da5b4452c2c667d19233bc4c48188564a0f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870693, "uuid": "3acaabf9-e92b-485f-8674-1299ead52813", "comment": "Malware payload (Tofsee)", "value": "596f24a3ee74a7e1a9c66d4d715b0cd715405fd1e20a41c2309d5dc4028c7faeb9150a067b65c435932eb27cfa91298e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870693, "uuid": "574ac688-d190-45d3-930b-8ba726fa8ef3", "value": "T11164398397E0FC40F9658B73DE1ECAE8761EFA908F5E77769218AE1B14710B2C163611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870693, "uuid": "40de0c74-fe00-47c0-807f-6ad78c81ee1e", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870693, "uuid": "50a07111-347a-4210-b8d7-c56a35bccdc9", "value": "3072:EPGQ/exKRNm1tt1QxwfIZs/k5Op5qFzpB5W5ppFgRLStKRxhUwb:E+QmcaW6IZgn52MpFggtKBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870693, "uuid": "9a37f840-be45-4943-9a9f-49d2c2d560c5", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870693, "uuid": "068761d2-490a-4087-9142-9b41bf357ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870693, "uuid": "7fad5160-aaee-422c-9581-00d95ce102a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4aa2b4-a7f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675891238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891238, "uuid": "4855838a-2a3a-47fb-86a5-158a57caa664", "comment": "Malware payload", "value": "efce3de616b3ca7259e681f71329d159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891238, "uuid": "f1ad9f3c-ac29-4b66-af33-1965d67b4629", "comment": "Malware payload", "value": "55b249de5e20eb9a49aa5aa3ce2303d0f00eeeec63e4eb1482aef8be3e5a6854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891238, "uuid": "bd529dd6-eadb-4489-b752-f04227be24ef", "comment": "Malware payload", "value": "789eb1667a7aae7c163cf6a795ddab67985e4710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891238, "uuid": "40341347-3a53-42f9-9e9a-dd8da6ed5fc4", "comment": "Malware payload", "value": "f64b3f1dc9e56e4b482484f7e3a57fd83756b1d7e814aa7fdbac94762b897baa770cd2e9afb2de41f3007ac4e4f5ad77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891238, "uuid": "e2dc3b9e-0578-4bcb-aa9b-ede8f9b36b98", "value": "T128641903D2D27C80F9668B769E1FFBE8765DF6608E5AB7693218DE3B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891238, "uuid": "8e36cc41-5a86-4315-a34c-7b2daf53c682", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891238, "uuid": "ec9bcdb1-0470-41d0-94fc-6a426aaf2d6c", "value": "3072:rPgByYLi3OU5RF+/vcFc6s79CUneq4JmWnVx8iHbnKvMbuzsWQDiuLprA84gv:rRY++C4B3wUnuZVxZHbkMaQLiqrAqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675891238, "uuid": "f06b1b2a-c86e-4405-85b5-80650b5db549", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675891238, "uuid": "a996e31b-3b21-4b35-b5cb-37250638695c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891238, "uuid": "d0b6dc4b-7eb1-47ca-b320-c2b059adb6fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ad8eb0-a808-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675899191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899191, "uuid": "26a4579a-d315-4bac-8fc6-c19c5b6f1a99", "comment": "Malware payload", "value": "77b1a603da73556d391fe24731b9ec3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899191, "uuid": "21e40a4f-826a-405e-a658-c29eac6addc4", "comment": "Malware payload", "value": "567ab64e4a8911251680e81f293d48e6b5bc19f4aae3030bc5d02852bbc63c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899191, "uuid": "b93f31cb-d03e-459b-8675-a149bd9be1a7", "comment": "Malware payload", "value": "ee8fc343fd3824a643bf15df46aa70537785deb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899191, "uuid": "a211ff09-1119-4cd0-8c57-198d80a4831e", "comment": "Malware payload", "value": "899e51004c7db96f681336eb1eef5525f47d5629cb2ee9115440d5ef935b988b58a18832f7dd5cff79dca172a0271a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899191, "uuid": "50b45cd9-0138-4661-9319-4c214568f749", "value": "T114C41207E7EC4136D9F567B019F106D30A39BE9197789346278E9E2A1C326E4B23173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899191, "uuid": "9514b1ef-aa91-4def-a3a4-9dd3f3f68b12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899191, "uuid": "995f0a4b-cd78-43bb-8fe4-7a21fc096fec", "value": "12288:kMrey904LGTv/VkzTT1sC6cRxeMoNO1OJilc7HbAZLK:ayaHOzdsCDxezNElc7HSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675899191, "uuid": "8920e693-25ab-438d-8cf1-2c531bc6d3e0", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675899191, "uuid": "6f2209da-be81-44a0-871c-291e37685d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899191, "uuid": "c512ba05-6f0e-4deb-af27-6f48e8db4ad8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b4ea10-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675852225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852225, "uuid": "9547c574-c02a-474b-8b50-0bac6ef1b123", "comment": "Malware payload (AuroraStealer)", "value": "a668737ef2d46ae6b220fdd6f4831435", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852225, "uuid": "8f14b9aa-ff1d-4124-bd17-cbd4e131d205", "comment": "Malware payload (AuroraStealer)", "value": "56aef8f9eeb92cd3658907ca36a637ecefc295464ec7d93b052b6a08373cf0e3", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852225, "uuid": "940eb99f-dea6-4525-b18f-e0a5170b26c2", "comment": "Malware payload (AuroraStealer)", "value": "56ea64379430942cc721dcbde794de8e0449aaad", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852225, "uuid": "246089d9-567f-446a-a670-d88e54b0f4ad", "comment": "Malware payload (AuroraStealer)", "value": "e8ef61cd644ea20b9aed911e24b416ded4cfd57551db8238fc456b526d81babdc2b3aa4e821a5c46b05130709ff10428", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852225, "uuid": "7130307b-c8c7-46aa-a8cf-9355cd245319", "value": "T120643C53A3E17C48E926CB73DE1EC6E8F61DF990EE0A37693218AE5F1871072C563611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852225, "uuid": "6630e1f9-f2d4-497b-a795-2edd5327ca6b", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852225, "uuid": "a747ea88-96d2-4564-b8c0-0a31f10467fa", "value": "3072:+wAq1MhGkwXR5AlSTrNv9Rj2WENqoF6GFfFTG+WByUAl1uBW2:+dWQUA+Bv9ZEooF6GF9K+WUjuI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852225, "uuid": "7da84a46-d8af-4218-9b1a-70468c813b90", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852225, "uuid": "2845f206-e81e-42df-a61c-a3fbdd271896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852225, "uuid": "a360fae5-d6da-4d18-84b3-5c0911aa8cef", "value": "56aef8f9eeb92cd3658907ca36a637ecefc295464ec7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654f9e18-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885638, "uuid": "f13d3f3e-9dcd-4042-bb9a-0bb835c308e3", "comment": "Malware payload", "value": "e5684e37b552ac0efee6dd9ded6224da", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885638, "uuid": "4d2e9702-6a10-4955-aa2c-ce3b77773609", "comment": "Malware payload", "value": "56b84008880dcf70364ceecb6e41be32f53bb27ad2cb7e3993ff7831abb38433", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885638, "uuid": "0e161818-bda7-42b9-b83f-32fe8d53eb10", "comment": "Malware payload", "value": "fc370cad30c15e4d75bad7ad62739f32edaf3437", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885638, "uuid": "baf517e7-68b6-44bb-941c-e90d4061d554", "comment": "Malware payload", "value": "edd88f8e2a88fad43b92092911c848ce01534e1d2873112cae8e5c2ef63dc74161491f919afb1e080d56d5a566352138", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885638, "uuid": "c8071eb0-1422-4fdb-b950-da0234556157", "value": "T1971192991DAABDE205C21A080CA80E2DAE78B8BC0C568140618D6D5C2861F026BB8A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885638, "uuid": "4c98f589-710c-4705-9b90-31cee2f57768", "value": "24:0j5fk4YwXBRe6FojLq//o30xU56WjhOKx866uqRZiYz:0PRe6ma/M0xUk+Bj5gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885638, "uuid": "9d15015e-612e-4149-9ba9-cde88efcd88a", "value": 856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885638, "uuid": "851a520c-ce3b-4fdb-833b-20154f1a93a0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885638, "uuid": "bd8f18eb-dc60-4bfd-93d7-b7dcb5b775f9", "value": "f52fa853-c7a7-43ca-a473-1086f4ced5e3.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd463cc-a7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675870858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870858, "uuid": "87f74f8b-7d6d-4ee4-a73c-f5d0c95bfca1", "comment": "Malware payload (RedLineStealer)", "value": "8926504db297c497f7d7467225c58bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870858, "uuid": "22b13248-1282-4ba3-b8ab-0c5c67576610", "comment": "Malware payload (RedLineStealer)", "value": "575e89f76b3debc6669f25460859fe2130ead8bc91ebd2678dc89d921a78a1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870858, "uuid": "4685b21c-d60b-44b5-85f8-0b3151d10710", "comment": "Malware payload (RedLineStealer)", "value": "a3580354937259b249c163ef5b31b8e9701b8c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870858, "uuid": "c59047c4-bcca-4e85-b968-2e4356f0fe0f", "comment": "Malware payload (RedLineStealer)", "value": "be0b4c58fd3c77dace465b4cf61b1e2f492c502145fda276f6b37e82cb1afc8556e7352ce6f48157c70fce2fdf70e227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870858, "uuid": "0f5af140-d5cf-4b38-a7ee-9a3588d449ce", "value": "T1A4C4121BE6EC4836E8F457701DF703C30A357F61AB35825A278EBC5A14726B4A23176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870858, "uuid": "67101de4-8998-4e00-b345-216c2f469069", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870858, "uuid": "8b94a185-2394-4117-b248-2354fe5f9030", "value": "12288:eMrXy90nFa9CKC3u/Y5vBRM4zHCKqobM5P7C67x0:hyy40KC+/Y5vBVDqobem67x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870858, "uuid": "1a917205-0653-440c-8255-b91d8517bfa3", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870858, "uuid": "8d3229fa-5fc3-426b-bb47-7b46eb5366e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870858, "uuid": "14f0cbab-591a-4106-ab7e-c9ab7189a6bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ecbed1-a796-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675850041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850041, "uuid": "6384a615-984a-4007-b2d8-76c92fbd6377", "comment": "Malware payload (Amadey)", "value": "3ba33e2ee71b972e3119c8c934e9be0d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850041, "uuid": "92713415-fecd-4967-9515-321fdb04d785", "comment": "Malware payload (Amadey)", "value": "57d0462b137a626ecc0d04400baa6cfdd9f8f7398affe4db80f8b88454d2a8ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850041, "uuid": "f28054b5-00e0-474e-9d17-f2248bd5d144", "comment": "Malware payload (Amadey)", "value": "7e6abf10f896537d80b43d5d9eb82aa5ab524414", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850041, "uuid": "c7e68328-a83e-40c6-af7d-ea1091fa7ba7", "comment": "Malware payload (Amadey)", "value": "82cbc4a8e312cab23b1a6ba7f864b5cec3643950dc79969f9289bcef8e899c76bbf0a882687eec80e4d5afb32675a731", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850041, "uuid": "460a9389-1801-474a-9513-9434a956fb7a", "value": "T1ADC40257FBEC8432E8A017714DFA12D31B36BDA09A6483DB234E6C5A1C725A0B635737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850041, "uuid": "68a163f6-ffc9-401a-a28f-1280f883ed06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850041, "uuid": "5ace81d2-7ccd-4252-bce8-008212dbdf9c", "value": "12288:iMrdy90eX0kcnjVDr6qNYQdEleck9eqQAcKe/Xs8TEpX:vy9XLcsqNYS539JjePA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850041, "uuid": "b818baaf-30ea-4564-86bd-8d2e292f982e", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850041, "uuid": "2db2702e-01db-4dad-b001-8b98a7aa7170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850041, "uuid": "b1685761-d239-4182-be9e-17698b82ac6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0af793-a79d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675852983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852983, "uuid": "ce4add0d-6587-4252-a2fb-845663df4386", "comment": "Malware payload (Amadey)", "value": "ae0f9c80598f7830f03f7a789745de23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852983, "uuid": "f75b46f7-0165-4e92-b95d-3edc8de4a501", "comment": "Malware payload (Amadey)", "value": "5842d0d6648cdeb83a46b8e60a39e35d6dac7b6b33bcef0171296a06648288fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852983, "uuid": "054f3af5-3e4e-4a81-a14c-3e16d88c2a4b", "comment": "Malware payload (Amadey)", "value": "2d52c7e651775e2b2969d4041bf1e327c062c264", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852983, "uuid": "5f8c6b7c-f6be-4835-8408-5c3bda972792", "comment": "Malware payload (Amadey)", "value": "76dc991ee475b2380aa34530e4a32c79bdb51240c8b9ebb88af3a562ccb302d4ff52c1ea2f0d8535053ffb846f803f3a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852983, "uuid": "f79c39aa-000d-40c7-85e6-f1c7cf0fd6dd", "value": "T16BC4020BF2E95122E8B15B7019F603D30E3ABE656B38839A170E6C5908B2664F675737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852983, "uuid": "ddfeafd3-49d8-420c-9932-ed2406902431", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852983, "uuid": "12ade2c4-e6fe-439c-afa6-84aa70e2cbdc", "value": "12288:kMrLy90Q736aHE5n26K0pDfSu9zxMFeJXEsXWZ8d66d:PyD73tHE52SdRz2eXimrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852983, "uuid": "d41f9ab9-f431-4026-a653-2ed540535247", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852983, "uuid": "428abc30-dad9-47a4-8c42-f3f8fc84f343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852983, "uuid": "69462c42-bace-4755-9e95-eb3e2743430e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5479f2-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675820070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820070, "uuid": "7fca8e90-e2b1-4502-89a7-9a30ae2492c7", "comment": "Malware payload (Amadey)", "value": "2bf0bf4a13dd93cff89d6a0ca1031d7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820070, "uuid": "4c670d70-6e80-460d-9b49-dfb71dddf7a1", "comment": "Malware payload (Amadey)", "value": "5847adcb8f14022775c3fe328ad7329e50f2cf9c418091f51f302be40ce9faf0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820070, "uuid": "28296673-5103-4073-a127-b62c96aa102e", "comment": "Malware payload (Amadey)", "value": "75f919304650629e01ce56c9f59c5efed4015092", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820070, "uuid": "b4745484-0ad4-4412-af7a-293c6a95492d", "comment": "Malware payload (Amadey)", "value": "5ef814b37eea9a8e091c278eae6d695be13158cf3fec0b725bbce114667b51577a90b3cc609ef98cc77205751033e866", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820070, "uuid": "4d979d1b-3558-4491-ab13-dca168d1212a", "value": "T171B4124BF6E85022D8B817B019FB03D30632BEA25B74C79B264E2D690C726B87535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820070, "uuid": "6963d59e-4c56-45d6-b255-46768bfde68b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820070, "uuid": "c3571b4b-8fde-4bb6-9691-edb7821e8353", "value": "12288:tMrZy90MwjgKzvPeGDrDHqQlFdVGZvLWDhVpTawwUKyUaW3vRTLm:Yy7wjTzPeGrplFrMWgwDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675820070, "uuid": "c22c0db7-b901-4cc9-98d7-0ebea1c57c83", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675820070, "uuid": "8e71ff80-f893-4e30-a246-5a2d35a52f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820070, "uuid": "398c801b-333e-40ee-ab0b-bfa34458d1d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ba57b6-a789-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675844429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844429, "uuid": "071761a7-8724-460f-95d8-ac48a0b97865", "comment": "Malware payload (AgentTesla)", "value": "fba149cd8208d979336796949da05eed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844429, "uuid": "860e6bfe-1360-49b2-a936-e0b889f41878", "comment": "Malware payload (AgentTesla)", "value": "5859ab1630a9c975f938cda94881c1efab0eee7d67125db2e7e65f5d80a0a57f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844429, "uuid": "1ebd9d80-59a1-4746-9842-c534363f731e", "comment": "Malware payload (AgentTesla)", "value": "d01b058b04f76298093f1c83093f84e7ecd07956", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844429, "uuid": "fa114541-e363-43b6-851d-b1cb913a2488", "comment": "Malware payload (AgentTesla)", "value": "ad8dafff6bf45d878095f57e83af045fbcd9b8cc387bd91791e0b403912abfce4d1b44d8bc930ad9a5071922dc53ee6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844429, "uuid": "6270baa7-30b4-4b09-9d87-749b07af9770", "value": "T1BDD4238B7D09AF16DFC9943BAB91CF5623911328202D5E915A77349D247CBFCE40A643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844429, "uuid": "1eb5f77e-66c3-4a10-835b-729f6d0cc0a1", "value": "12288:tZsnn1ahnSXE4iecDK1l6PTfD/U5vtcKSNGk42v/R9rOACIFFb5p7hk:tOIho4K1YPDytLk4E2IFl5p7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844429, "uuid": "0a7370af-e94f-4baa-ad1d-7e559799edee", "value": 628507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844429, "uuid": "9292690f-ce32-4b44-93c0-0674b76cb57c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844429, "uuid": "7afa9089-e5b7-4591-9188-85287f5d3612", "value": "PO 409730-273.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1efc94-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880793, "uuid": "6be8dfed-9a46-4b2b-b1e9-b214343043e0", "comment": "Malware payload (SnakeKeylogger)", "value": "514234bf835f51499d6a56b2bf114ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880793, "uuid": "b4c52997-cb0a-4aea-a3b6-012e19aa7ed2", "comment": "Malware payload (SnakeKeylogger)", "value": "590e497de096f79ae56d190c9dd4904cc9cd1ec2885c1703f7aefa30eda0bd2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880793, "uuid": "1cd19f7a-7745-475a-806c-c7a8ff99cce5", "comment": "Malware payload (SnakeKeylogger)", "value": "08108719d64f7ed0508e9982db0f07a974c14e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880793, "uuid": "0edc994a-13d4-49ec-a37e-f245305546e3", "comment": "Malware payload (SnakeKeylogger)", "value": "3fede45be6a04ade9f3b691ed141ce735c5fcca29005f67dc24cb9b0b9a9eb7a63076cf0931f816f9927243c89ad1a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880793, "uuid": "3d8326e8-e035-4270-9d5c-b3da6e60d1ec", "value": "T131B45E2D39B613E2C138FA7A46EB8620B9BD62933303D958D9DE1BF04F855416E8F51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880793, "uuid": "94ef7df6-d07d-46d1-9e5d-6472847501f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880793, "uuid": "3b67fe96-b92c-4eb2-bb3c-b6fe064df35a", "value": "12288:dBhVe5d6U6sRg9db30NOQA+/7lrX3fc0dObo+eLxT2PH+hfk8:9LsRg9db30NOQA+/7lrX0kObopLxT2/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880793, "uuid": "6410b595-36ca-47f6-a77c-13f032759556", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880793, "uuid": "1a6bc517-9801-44b1-bbae-c48ac22e84d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880793, "uuid": "23fe76ee-7195-44bd-9ff4-857a663a414c", "value": "RFQ.#626MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcf6c92-a7c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675870248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870248, "uuid": "4f4d9b46-c8aa-4222-ab35-26b5b42f59fa", "comment": "Malware payload (RedLineStealer)", "value": "b05a7c25c8f86039b59b0a583f1b33be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870248, "uuid": "9d6a68c5-f7ee-4f01-8111-78da2889b915", "comment": "Malware payload (RedLineStealer)", "value": "5a2b69f5cd5dd2415f4b8be3db3404b679cd105448a122f9b01a02e5c52ab496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870248, "uuid": "4c3d9d3c-aca7-4f7f-b1a7-7c7b4a1cd7e1", "comment": "Malware payload (RedLineStealer)", "value": "b4fbc6dc7c66ce362e1751f6e7f850f92831af19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870248, "uuid": "4f2f98d6-1923-4f55-98d7-0f006a2c7157", "comment": "Malware payload (RedLineStealer)", "value": "d421a54af449fd928f3fdc246b18e43348e15989f8543c86221fe05e5707ec1bf195f111bec47c7b0dbad7c24aba5719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870248, "uuid": "d5462efe-cf6f-4d74-8f44-d7a693a00237", "value": "T1F9948D8397E1FC40E9628B33DE1EEAE8721EF990CF5D77769618AE1B14710B2C163215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870248, "uuid": "443e7a4e-d878-48a4-999d-b42d99319fe3", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870248, "uuid": "4a8aa1c5-60fe-4644-abea-b84fa4e1ff5e", "value": "6144:d7tQ9tKcunbcGOadkEsQrcZnZsKiLVYuoggtKBP:duTKcbGOaqEsQrSnZZ4gtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870248, "uuid": "5f07ef8c-bf6a-4a7f-b92a-62d5e5a69e62", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870248, "uuid": "e738812a-c15f-46b4-90a9-110e900b33d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870248, "uuid": "cf802a52-721d-4f96-8fbe-9070a23b7ad3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fc69bc-a7ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675865473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865473, "uuid": "46b0618d-75f8-4a3c-aac2-c216a9ce2292", "comment": "Malware payload (AgentTesla)", "value": "e4043d41252c37a16e4c182a7f3a6a78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865473, "uuid": "ee8eb4ea-b0b1-4b20-a2f7-94922fbfca96", "comment": "Malware payload (AgentTesla)", "value": "5a33ab9d4ba9f6e181aafbd78846f9f0be7e87605400e1ec74880b358c9ba94c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865473, "uuid": "38239729-20fb-466e-8440-74830fa1e861", "comment": "Malware payload (AgentTesla)", "value": "b5dddd62bb02f0a8ea431398f4168ecef2b223e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865473, "uuid": "ef1ab867-58db-49bf-8301-6a87fbebe574", "comment": "Malware payload (AgentTesla)", "value": "88991d1c408e225535305592a1db4dd8ac3877899085a274750cbada5f79d2e79999cb8beef73e57100a95945c979d8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865473, "uuid": "0259030b-ebab-4c26-bc12-3fdf9f539c9f", "value": "T196641214B6E29027E93307321F36A153DF98F5261DAA475B87404F0AFE61E818F6E3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865473, "uuid": "c6c23253-38be-4850-a484-62a87e0e5221", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865473, "uuid": "913b7607-ddc7-4cbe-bf8a-4b781efd1853", "value": "6144:/Ya6PJRKN8DVkqrTpXhI90RmoqoDagngNYurgQqzcDeUuUwEpm4RF:/YFHb1rvIpoba6EgQqwnwh8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865473, "uuid": "20c2c970-28dd-431e-8e88-41685f67ff75", "value": 323202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865473, "uuid": "08fb9cc0-11d4-414e-8f27-ed71ab26ed8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865473, "uuid": "f652629b-57ca-4b07-9e36-bfa8db3dd5ac", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3013921-a779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675837772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837772, "uuid": "0746be4b-2a1c-43aa-844d-5ce36ff49fe1", "comment": "Malware payload (Amadey)", "value": "642e6e0a5043befc0742d2d6bbde7207", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837772, "uuid": "0700c4a5-1d40-485a-ab69-d9e1a210f777", "comment": "Malware payload (Amadey)", "value": "5a621bed22907ed1c550d9b110c0918a3ac1e46cc60367a9b51010ed39c72359", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837772, "uuid": "bcb930c4-48cd-4d14-aba7-b21c2cd84e99", "comment": "Malware payload (Amadey)", "value": "1fd0883974979bd23f63c738fce3ee37e88acd65", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837772, "uuid": "192376fb-2859-48b8-8acc-daa2a2ada451", "comment": "Malware payload (Amadey)", "value": "ff539c8255d032a6225f4dc97e97a786eff0f9c30e797a7aeb75f356ee1df571b65d4345825d623645c56b5a1a0854ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837772, "uuid": "64d66308-3fa2-4483-9b8b-8f4b94dda088", "value": "T1CEC40257F3E89073E9B067B058F603C30A32BDB56B3882AB128EAD591C735647634767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837772, "uuid": "ad81d82a-1fd5-4d45-8f04-387d2042dbeb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837772, "uuid": "0db810d8-82a4-4f83-9731-c107f1c033dc", "value": "12288:1Mroy90nnCkydAmzHvhhezbKYOq2HueBJvopkABi+29TF:RyRkNmbvhhezbK3TB1lDTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675837772, "uuid": "1aedd941-2460-4921-9e1c-0b7ce0570709", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675837772, "uuid": "7a1df871-5733-48f8-973b-e82bd11d7438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837772, "uuid": "535e1140-818c-4a49-8bbd-cbfb61550944", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7901f39-a802-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675896540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896540, "uuid": "734d1e72-98ef-4234-aab3-1a889779f1d3", "comment": "Malware payload", "value": "c0685600c32aa5f5e45212e01efab850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896540, "uuid": "14886a25-2e83-42cb-ac0e-d8aac2237f1a", "comment": "Malware payload", "value": "5a74273539a98de2a2893419bf1a2221c3394d45b95dce5fe9ddcb07e3cb3266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896540, "uuid": "6b174429-1f7f-48c9-9ddf-42902421165c", "comment": "Malware payload", "value": "8efdfdd7010e6fe1b4b782bedb57dee36a1ec004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675896540, "uuid": "5f77a57e-849d-4263-a3a1-bc0a82371d71", "comment": "Malware payload", "value": "7ef8150d38bfff580b2c0c27af79c333fc5dac77c21c91087cb36c8f8eadbbc8e4920c0adc29f804bde5d666bcdd3585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896540, "uuid": "93208246-5023-4e16-8722-6eba5d91c05c", "value": "T1E4C4120BA3EC1532D9B127B01DF502D30F35BD90AA389257268E9D5E18315A0FB75BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896540, "uuid": "17d6690e-5488-4903-bb6c-6bd348fa7aa5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896540, "uuid": "c7157c76-85da-4952-8ed9-60c8e09609d0", "value": "12288:+MrCy90NvQfHEHOKBi0C6cRxeIoLkbOJblSfQz68pJ:syiofH2zHCDxeXLxl2kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675896540, "uuid": "5fa7d59d-f118-4684-8458-d94c7c3117bc", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675896540, "uuid": "78a6878e-1032-4179-bf44-3536f62f9ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675896540, "uuid": "9a72224d-cca9-480c-8ced-38b40483e83d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f9f16c-a7d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675877561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877561, "uuid": "ba4bd838-7e9d-4370-b330-5a9ffbb06229", "comment": "Malware payload (RecordBreaker)", "value": "949fab26e62f659e1462f0ff24203732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877561, "uuid": "ce7a3b36-3410-440c-9da9-07d771ecb608", "comment": "Malware payload (RecordBreaker)", "value": "5b2ed851a2006c4c98d50de5a8a8a214441c09c24bdd3f8a56001fd85ea8c9d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877561, "uuid": "b5f93bec-031d-4797-a778-d01ab524c8d6", "comment": "Malware payload (RecordBreaker)", "value": "aa227c7d9854740e3d30cbec7d6d36af2747db40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877561, "uuid": "a87fc8e9-d8dd-41c0-9b88-33b4e746ff8e", "comment": "Malware payload (RecordBreaker)", "value": "e52671619eb0b788033227e1fa487e6e6130cb514bbcd4ac944ea21d19405c3fd47b5e2a39e7595e9f13974764fa9f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877561, "uuid": "506f1782-acf2-4065-b7b5-1f2356ae6379", "value": "T186641903D2E27C80F9668B7A9E1FFBE8765DF5609E4AB7653218DE2B14F0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877561, "uuid": "73e9c57f-4b75-4ccf-8312-8e18d01834b3", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877561, "uuid": "f7d4df75-6a3e-49b6-9a60-af0dd6f4fe74", "value": "3072:YPg2Ia2tdxR9Epap7q17MaSULL4XZoR3Zd05AiL65sWQDiuLpCxF4v:YdgtrEpr17YU8I3ZC6iL6eLiqCx+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675877561, "uuid": "7bcbf878-f0dc-42c1-8827-0926134dd244", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675877561, "uuid": "e2b3c764-5c6b-492a-baec-9777e368c08b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877561, "uuid": "68386f9c-7a1d-471f-8bb9-4f5504c9e796", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d06687-a7b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675864538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864538, "uuid": "75feaf38-0cb8-4d92-82e8-d3b0bdeb4298", "comment": "Malware payload (Amadey)", "value": "2ec9f2173bee38a8cbead99b2745be9d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864538, "uuid": "1a85a472-d375-46a4-b07b-dfe3467f05bc", "comment": "Malware payload (Amadey)", "value": "5b38964c44cbec79864c7f6bed588e3e2e2ee370640bb08f9b435380b1743dca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864538, "uuid": "4dd813f8-303b-46d9-ba90-19e3d2260d0f", "comment": "Malware payload (Amadey)", "value": "49041f8365e80915f845a411013332a3537f01da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864538, "uuid": "01a32cee-ac5e-4084-a25d-e013a3ffb6f0", "comment": "Malware payload (Amadey)", "value": "420163bd4098e24ef7143ab204ce09120e49b075cad10f46b945e8b44c7443857b8af7b5595995c38a91bc5963a38a0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864538, "uuid": "8d3704b7-31e4-4c39-926c-1639fa596442", "value": "T103C40207EBE88426D4F54B7069F603D30A36BD605B398A8B274F6D5A1C725B4A23137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864538, "uuid": "6dac803c-b539-4eb1-bbc9-c591ce3f5eb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864538, "uuid": "8801c981-3229-42f5-8a7b-81b7ceed332b", "value": "12288:0Mrxy90jXLQ7oyDIZrLUe464OEarSatjmBMGN4wEeD7:ty4YogIWp6mdatjmB/SM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675864538, "uuid": "3276d4c8-eb50-40a7-a840-b716fc22bea2", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675864538, "uuid": "a3075e51-684f-4713-8fd6-69abc6d071e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864538, "uuid": "961efef4-c2e4-44e9-8a23-b7aa7f32b13d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f0482c-a7cd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675873825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873825, "uuid": "0abf5cfa-4460-435d-a524-d1f574f84ce6", "comment": "Malware payload (RedLineStealer)", "value": "05cce02c0341e2ccb097cc41bac3a92a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873825, "uuid": "4553688f-13f0-4104-b809-16de7a3c58f1", "comment": "Malware payload (RedLineStealer)", "value": "5bab80a861d325c8cf98c898f427da01676b465de826543fd435b7a7ffbafdb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873825, "uuid": "96cba396-7b58-4917-9df5-df2dfc6b23f2", "comment": "Malware payload (RedLineStealer)", "value": "d246a6d26cab9b912e778f34e0a088256e4f5c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873825, "uuid": "d8aa6d41-6409-4c04-ad25-5378f5e5e9eb", "comment": "Malware payload (RedLineStealer)", "value": "1b7ff4a8ced21a50c775f3a0d74156b21bd5c1c9a9d9e97fc78c0345a2604fcd5bc95c583b98aebb2d004decef1900ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873825, "uuid": "ce2f6a6a-786d-4edd-96eb-57e2319bedfd", "value": "T175945B03D2A27C81F9658B769E1FFBE8765DF5608E4AB76A3218DE3B14B0172C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873825, "uuid": "a6734150-2483-4bbe-ba41-8b8088f5c50d", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873825, "uuid": "ad07928c-619b-47ba-98f3-7bc8c6527afc", "value": "6144:L2Orptl2sH4+mNBHJ3mFAJQgxYiYs8W/sUxLiqeBlv:LX9Pj8p37JHYXoho9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675873825, "uuid": "e3e24ab2-601d-4a8a-9ee9-94ae47fc665a", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675873825, "uuid": "0c71110a-a3bb-4beb-b34b-9e40e75fb5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873825, "uuid": "4496e1ac-f2c8-40dc-82b1-842653277a72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdba627c-a808-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675899101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899101, "uuid": "c702b7dc-e275-4d99-ac71-e6be5e317b36", "comment": "Malware payload", "value": "4f8d5a329bbee9bbb5da2e35c80925f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899101, "uuid": "eccfd7a3-d1da-4c4d-a1a7-eab7383f4514", "comment": "Malware payload", "value": "5bc32a58f9b88113f74eaf0c82cda9afc6af94af377b90a9e05676fe1523c642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899101, "uuid": "50fcca68-246d-47ab-af95-d9691124c73a", "comment": "Malware payload", "value": "206a1a2744bba94782a0dda3fd42d29aea366782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899101, "uuid": "96bbbb9f-ec05-4b29-b81f-a4c49e865967", "comment": "Malware payload", "value": "8ad54b70defa69a0007062f1f4342a34db9ff40f6322e59b356b36a4d40cf8786c4e890b2be4625a5b2a8465c2c1131b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899101, "uuid": "0e7dc89b-b51d-4287-9bb1-75bb57f06f44", "value": "T14AC5127C7106C8ADD290FDB48C3A94E36CE76DE3E9E4942270D97F3F95B96849A09103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899101, "uuid": "c6906415-aac4-4059-b3ad-c1a55b06e01b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899101, "uuid": "af94b067-f71a-4938-a7c1-3b0fa72b084f", "value": "49152:rdH/q/B1xrGeWbhxDTY6k0jl7wP0MpALCgv2MR:JH/q/BcVtE6kusMsov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675899101, "uuid": "aea31429-0845-44e5-876c-b4f31a3e90a1", "value": 2692022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675899101, "uuid": "a47e2c93-6803-48be-963d-a09450b94573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899101, "uuid": "ca4e5c7e-41bc-4a9b-b8d7-da9e794565ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f40149-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675882067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882067, "uuid": "643fa2cd-c6c4-40da-a137-fbe24a31e6f3", "comment": "Malware payload (Smoke Loader)", "value": "7ebf7d10757260b6666233d212869cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882067, "uuid": "990118dc-a80b-40af-993d-06ece0c9129d", "comment": "Malware payload (Smoke Loader)", "value": "5c215b927e55ecd01db0d6f4231a873085871503cff180f9476fdf46ea70327d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882067, "uuid": "98ca1ffc-264d-4208-859a-5c919f2a1a91", "comment": "Malware payload (Smoke Loader)", "value": "80dbcb65bc104b60ceae19790c2eec58f1977746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882067, "uuid": "34436050-1fb4-4f05-9ec3-ca09f7c7a0dd", "comment": "Malware payload (Smoke Loader)", "value": "303d4f250f889ada5b4897d5af326de825a2247242c5750aff9fd36adab88513c4f8ba097cb40ce3e7d164a2c530b8b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882067, "uuid": "40ce64d1-6156-431b-b821-f4304e2d36ac", "value": "T156B2BA016398D778FC233E349DA717B00BBABDCA8821AF9F98407ADABD79781C515750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882067, "uuid": "df9878c7-5f62-4e61-b149-f068965e51c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882067, "uuid": "363ff1a0-87fd-454b-81c6-1bb588977479", "value": "96:A8pQb48e0TMo5B1FOlbxn0MGk+NiRB4e3T3eJMnMMKkCMMdzNt:ASdqB3OTnpr+iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882067, "uuid": "fb863c84-1959-46fb-850f-d8f6a324dddd", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882067, "uuid": "fc7203c9-9bc8-4a84-8279-14d5f64899e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882067, "uuid": "1ece0d81-6705-4327-9706-37d01cfcb2b0", "value": "7ebf7d10757260b6666233d212869cd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb02744d-a78e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675846698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846698, "uuid": "4851cf98-2f1f-427b-9331-b5139d177b46", "comment": "Malware payload (Amadey)", "value": "a7bfbbf09f9295f8ab3638d8eb5b96e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846698, "uuid": "36340362-513b-4cf7-a19b-4371bc70e753", "comment": "Malware payload (Amadey)", "value": "5c2693a7907e1b1d9ccd151dcade53c35893c0c122dc96fd38ecd19162e85806", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846698, "uuid": "7a26ca8b-63fa-4779-a7a5-b98becefb0df", "comment": "Malware payload (Amadey)", "value": "b2fac195ddaf56be199e28bafdb84572ef4c2845", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846698, "uuid": "856203a6-a6ee-45bc-ae95-cb5cedc1b4c4", "comment": "Malware payload (Amadey)", "value": "495e4394ef2fd1a4193fb7a1a9fa04bdd622a76ef4a32051047a5c73a981b8b59e4e05733e36ff1490d8e10adc61bd20", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846698, "uuid": "924a80b8-d633-4196-9833-26c040555e96", "value": "T177C4120BA7ED4022E9B597701DFF03C30A367D109A7882A6634B6D6E1CB2675F671363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846698, "uuid": "32c5a2ca-2eb3-4dab-8949-1747439f1993", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846698, "uuid": "ae2fd2de-6551-4b5c-b7c1-94201765be05", "value": "12288:AMr1y90EuGPG7WBXDKxPEXIj62h456J+Pr3CwL6U/3HkVTXbX6R:lyzdGKBOPEOTMHBL//4TXL6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846698, "uuid": "536b9348-f570-4bf5-ae9e-7234a5076cb6", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846698, "uuid": "e4a7925e-6d89-419e-b10e-356d1a947968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846698, "uuid": "b35e8677-14e4-46ea-81f5-36ff0f5224a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb5957a-a797-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675850437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850437, "uuid": "a2de623d-e351-48fb-9901-f648ab4f5b26", "comment": "Malware payload (Amadey)", "value": "c680ab17acb1c8d118af33603b1a00df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850437, "uuid": "a0e6d61d-f728-4325-b1ce-141a285b85b8", "comment": "Malware payload (Amadey)", "value": "5c871810e29e112f315d791781e4a3bb2139528fb8fdf0fb9e0e49af6c1f1b8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850437, "uuid": "a0390943-e37e-4b80-ab7c-ad2edf7201ea", "comment": "Malware payload (Amadey)", "value": "14748ee5b3fcfb9316ac2389de413b89a561a12e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850437, "uuid": "51f0def1-9593-40c1-a8d0-67e69cdd913a", "comment": "Malware payload (Amadey)", "value": "d51ed84f9072001f5c513035a4d1712ae953d37f901968fdd2f7ecd1cc63b65a8354f918ea02de858a33f69d6a62a234", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850437, "uuid": "867ca962-da48-460f-83fc-5249249ab74d", "value": "T1E7C40207E6E88132DDF4177409F642C31A36FE619E3883D7628EAD5E18B35A0763572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850437, "uuid": "e70af89c-e2c2-48be-97cf-b100ad13aea6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850437, "uuid": "3055274f-ac10-4e11-84df-f1f3781db7d3", "value": "12288:LMr9y903QhrAy3Vew7skceANYrdlleck9eCQ7cKBo4BOq3hv:KyaQhrAUVecskdANYZu39xgBYq31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850437, "uuid": "6402697c-b92d-47da-b2bb-b1110700a093", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850437, "uuid": "9c35541b-5b1c-44e2-865c-12c47ea1bfae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850437, "uuid": "2c000c7a-f212-4a32-aa03-e21276d1948b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bd4f39-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883282, "uuid": "1db272a8-8cba-4e11-943c-c3542bc3ae81", "comment": "Malware payload", "value": "698523abd320ac629ee78f43e19b826d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883282, "uuid": "f0be7b8b-42dc-421c-ad9c-807559fb5c05", "comment": "Malware payload", "value": "5ccc614c91e41a7db188f2bac526bc2eb535d3f15d946ba916863fc7689fa2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883282, "uuid": "a7abb406-a9e5-4f22-a351-dcf7ecae34c4", "comment": "Malware payload", "value": "dd3b3b2bb36e5371d0177bf88a874d94e6a501ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883282, "uuid": "2d1d860c-5127-473d-b767-483e199dd09a", "comment": "Malware payload", "value": "a6fffef249fb94f4ad586b58200b66dadcab1156f497011c2d4ed0ab72d00cafc5f256bea48ce0adf9d92629267f853e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883282, "uuid": "e429081d-b909-4cd0-955e-5fbf455f5d1d", "value": "T1D564BF02BAC198B2D4631C335A796B21A93DBD202F75CEDF63D42A5DDA315C0DB317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883282, "uuid": "3b285573-db6f-426b-acc2-183e31f796ae", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883282, "uuid": "b06423db-4e9e-47b2-aeb4-ca7d5d880b44", "value": "6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/z:2ToPWBv/cpGrU3yVtX+t4Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883282, "uuid": "b98831dd-0f03-49a1-b648-adb6b4cad587", "value": 321090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883282, "uuid": "bd040199-03fe-4480-85fd-6c6ad532d007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883282, "uuid": "f787b60c-012f-400d-a1ee-6acdc66176c0", "value": "698523abd320ac629ee78f43e19b826d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d31bccd-a7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675866163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866163, "uuid": "4a7d7325-8323-455c-b150-4197e8a44b7f", "comment": "Malware payload (Amadey)", "value": "12de749b74da1d865dccd7a7fcd08cbf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866163, "uuid": "5ac97280-abcf-4d35-8555-449b75d77114", "comment": "Malware payload (Amadey)", "value": "5cf6fc13327706a7c0fdb1a97f813cf7537bc4f75b2193c7d73d1de7d93d19f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866163, "uuid": "4c660b35-3ab1-4083-bf10-465ef79cadd7", "comment": "Malware payload (Amadey)", "value": "59707efac3e28decb79c3a0981d434c6c906dd3c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866163, "uuid": "cc6447d9-d33b-49bc-849b-73b4cffc77ec", "comment": "Malware payload (Amadey)", "value": "21266783923541c7db4903c381229bffe6ce42360e06830580b3b99f45ec11db14ddc186b2b6c2fa930bb360cf3ae3ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866163, "uuid": "b8cf805b-cf30-4236-963b-a34eef00bd79", "value": "T1F6C4020BE7F88472D9B86B700CFB03C316367D909A34866B729EAD4A18B36747575327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866163, "uuid": "1dcf4793-ebde-48f5-9007-ed4f794eff44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866163, "uuid": "ca214721-0086-4710-a2b8-db00bc9de2c6", "value": "12288:/Mr+y90iv7SVUkwZ1YmcjDHVNN9WZHSJqobcr/fJ9nLb2iMYlr:NyqVU3Z1YmiNN0Wqobc9nWpYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866163, "uuid": "90fbdb8b-36d6-41a5-95b4-a7d454b0fad5", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866163, "uuid": "44cb0591-b5ab-4dc6-8420-66ebd5f254b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866163, "uuid": "6b912e8c-70bf-4ea1-b0f1-32d805cc7bec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc50ae05-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675854109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854109, "uuid": "b7a6c6ce-1946-4256-a428-226a65a11f4e", "comment": "Malware payload (Smoke Loader)", "value": "b4d826b8bc25a8f5c6e7c12f8dd1403f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854109, "uuid": "84ecec27-513c-4628-90e0-3725506928f8", "comment": "Malware payload (Smoke Loader)", "value": "5d9658e1be792166c8c2dff392b8952eb4014c92290051627af8b9ed8db217ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854109, "uuid": "94294e0e-c148-416f-b6e4-58f42c30475b", "comment": "Malware payload (Smoke Loader)", "value": "96707fda4bcdbd7700e446de983f54e6ec94565e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854109, "uuid": "f9d172eb-4997-4319-98c1-e43c3fbb7981", "comment": "Malware payload (Smoke Loader)", "value": "35e2fa51535894dcbd31004769540f21728d567f46eff86e24d6b58cbce8a30f122f9b6c89d51fbbd40a6aa4b8f43ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854109, "uuid": "a04746f6-6438-4f27-abc9-c18e67376a75", "value": "T121643B63A3E17C48D9258B73DE1EC6E8FA0DF591FE4A37693214EA5F1870072C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854109, "uuid": "80e44554-f205-439a-9489-e07ea61803bc", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854109, "uuid": "7fac9d25-2b8f-4666-9fc2-aa238756d783", "value": "6144:hwqQ4gVi9ooW0rQ8swUYyvtogWUjUagIL:hbZgs9ooprQ8q5Px6IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854109, "uuid": "7e3f4a28-1bb7-43da-8bf3-a4e7fb2e5570", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854109, "uuid": "864a0c04-3382-4fd0-a82a-67a4c05bcbee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854109, "uuid": "fb4232c4-a773-49a1-b331-5e46e3858098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60eb603-a745-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675815444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815444, "uuid": "0b3264d9-250d-4cde-9c0c-005234392cdf", "comment": "Malware payload (GCleaner)", "value": "9492dbe658320e26f4e14070a0a0f52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815444, "uuid": "31849c63-fd80-4beb-92e3-b5b2ff83d3ba", "comment": "Malware payload (GCleaner)", "value": "5e1e81c09eb10f4db9133b432e99f577450b513eeae5d19c267b7482196f3840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815444, "uuid": "5023f1d1-5337-4f24-8d30-5466bec0eb4d", "comment": "Malware payload (GCleaner)", "value": "c3e6270977a5aafaa7ec949dc44823331b6d1f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815444, "uuid": "114a7235-28af-461b-83d5-655882a27f85", "comment": "Malware payload (GCleaner)", "value": "931748baccbaafef380e756713c8d4fd5813fbe80747a01e67942df8b43a576fc8634740ae721acfd107ae6ac7ec0fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815444, "uuid": "b089f02b-7b7e-4468-b34a-391e5ce1e9c9", "value": "T105C5E00A5D94D0A7D2608F70D9C76DFA4C12EE6FE8BA009713043FFBB231249A95AD75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815444, "uuid": "1565fa18-5e57-47a3-a18f-d8de5bdd03e7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815444, "uuid": "880bf6ed-c5df-4efd-8634-5bb71fc306e2", "value": "49152:wDME2ADlYbDbp6GZZk8/cKZvML9QvNPlx9T2pvLCgv2MR:+Z2SODbVTUKZELqiv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815444, "uuid": "4145000a-8aac-4342-b0b7-f673b79b01e2", "value": 2727204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815444, "uuid": "91f61b9d-b347-49cd-a3a7-6f1e4f49ff09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815444, "uuid": "f672d43c-121a-4fec-8e70-8983ac66b935", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556357c9-a78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1675845668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845668, "uuid": "a864f01c-b6c4-4e9e-8dd8-823a7d39f0a5", "comment": "Malware payload (Kutaki)", "value": "ba62a3fe1ef370a7efd7abe232c71619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845668, "uuid": "357e6630-01fa-4732-9531-c211d2bbd229", "comment": "Malware payload (Kutaki)", "value": "5e68db0fc4ba7e505cb1d59e9db3c1c09ab83d0d5f1d2e28e0446ee8c6fa3081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845668, "uuid": "8bd25f02-ae8c-4d89-81f9-b6b84e9cc38e", "comment": "Malware payload (Kutaki)", "value": "ca160ffe9550aa4c14c37522dade8aafa50a42b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845668, "uuid": "d793cad1-2679-4d95-8390-4f0b0990622b", "comment": "Malware payload (Kutaki)", "value": "da2ec7ae9908e112194351a5071b5c32ef6e69223e73052843ec8aeff4ed18c0aef3c0fe102069548d584f43e3d7033b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845668, "uuid": "5b364834-0be2-4805-8c94-47ccf0cd07b3", "value": "T1A0D48B03E150F10BE553C8F07928926F6A1A6EB61180AE57B7C0BF4A6572AD3B4F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845668, "uuid": "118bd17b-547d-4a07-bb05-5a8bb2bf0343", "value": "d8691d7b0272ebb74665194a57bc3e64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845668, "uuid": "cc96c736-cfdd-49c9-8838-5bcf04d9d334", "value": "12288:5AM0xGDBOY+OxjAfwq46A9jmP/uhu/yMS08CkntxYRWL:5z0xGDBOYXQwVfmP/UDMS08Ckn3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845668, "uuid": "368f3905-d786-4a70-b385-bfecc30f2fdb", "value": 607442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845668, "uuid": "c7a5435e-1810-45da-a7c0-8ffe03207965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845668, "uuid": "395037a6-cae8-47ee-818d-44db35b4370f", "value": "Challan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d818581c-a800-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675895709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895709, "uuid": "e5b6016a-e210-46e4-90f1-be53048a8820", "comment": "Malware payload", "value": "eeedc690ad051487e03c5113036d52ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895709, "uuid": "f5ea619d-8d16-46df-ae09-5f813b2ef7af", "comment": "Malware payload", "value": "5f25ca32b24d80a53f59a82df09afbd6580e618c35467ec3ebf787355c373e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895709, "uuid": "d02532cd-1e98-45f7-b29f-7565d7eea9b2", "comment": "Malware payload", "value": "895818aab37bc84d2f77998fe412725b05fd8ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895709, "uuid": "3a0172b2-fb05-41c7-9a62-0aa376930c25", "comment": "Malware payload", "value": "dff32a9edf64c76fb34c443d04920f19acaa05937a9410f6abf3a86ee903c323ba33bb19e412778e62d48b43c4c6d89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895709, "uuid": "8cfa765a-9c36-4410-a1d1-a117a41db91e", "value": "T1DDC41207B6ECD036D5B097B01DF207E31B36BD506E3C83A7224BAD5A18B25A4A735367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895709, "uuid": "cc9920cf-b6e8-4aa8-a86e-f5bb553168ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895709, "uuid": "26e45642-743d-407c-9bed-6930b7a358dd", "value": "12288:VMrVy90N14yDVFTY+tenL+YoqhqNK6Xi0Kp7fEbwhkTZ:8yO1HV5Y+cnL+YbwQ2iDYwhMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675895709, "uuid": "9201160e-f1d5-454c-84e3-b7adb0460fd2", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675895709, "uuid": "ce38dda0-1ae5-4982-bdd1-f0b5e647d096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895709, "uuid": "ac09b47c-3bf5-4296-8ed8-6a220882e305", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4614b0cb-a77c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675838771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838771, "uuid": "5fa0dade-c844-402d-91c5-62f6fa04bf4a", "comment": "Malware payload (GCleaner)", "value": "a306a4c633eae6d743dd84409ef3695f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838771, "uuid": "23c5030f-1b7a-4bc5-8135-b76adf6cecfb", "comment": "Malware payload (GCleaner)", "value": "5f6626b037bf23d753aa9d9c5d25cdfc6a422a1746ef65aa063794670cb91124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838771, "uuid": "d4b69e2b-db0a-4388-8361-f4ab3190d8aa", "comment": "Malware payload (GCleaner)", "value": "8441b487b846576737b149ac57c2cbf4f38e3070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838771, "uuid": "f744041d-7188-4b75-985e-d5ee93419225", "comment": "Malware payload (GCleaner)", "value": "33e08e81475d46a2e52f9acb13170d4f7af2cd4dd2f90a2c58338875402a32d4ea7e4c93fc24f943e56bf78bace39e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838771, "uuid": "a69ad58b-6587-4762-91d3-edb29cfe2180", "value": "T165C5123D7115D86CC280FEB48C3A99E71CDA2DE3D9E4A42270DD7F3F92B91859A0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838771, "uuid": "77cdf2dd-b36c-4543-aae1-8616e3776bcb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838771, "uuid": "87d89014-59bb-4500-b5cd-17ad496edf9c", "value": "49152:rdHkl8K8RFf1e2BD4tuz0GAV1ZhNCdWxAGNgI/vWfD3DGLCgv2MR:JHIEFfRWckSWxAGKI/v63D2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838771, "uuid": "6ebe1cfe-0707-4a81-ae9d-e372e8c5ef4b", "value": 2716297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838771, "uuid": "9e01e7e8-b5cd-4f97-8b86-b166bbf2ebe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838771, "uuid": "50fd1bc3-06f3-4b51-a6cf-25cb6029a259", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d990fd4-a7f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675888954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888954, "uuid": "5563c730-25c1-4055-8689-d4febbda6530", "comment": "Malware payload", "value": "fbd95d9cfcb07b34ab19a5196b497177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888954, "uuid": "98b8d2ea-147a-48bb-916b-c5c016c6305f", "comment": "Malware payload", "value": "5f99a43aba2d7607dcad3c85e6ce7daf061d1866cf6be3fa4460c8a4dd3a46c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888954, "uuid": "c0c6e13d-5191-4e97-a716-d610d437407a", "comment": "Malware payload", "value": "e15a33c50f6515245377b93d901a1b68410dc366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888954, "uuid": "16274a25-0cc3-44df-b5cb-86b55f6a2606", "comment": "Malware payload", "value": "05e4f0639bbf05a9080293bf4c1cfda97441e74de7447d6f0b30716ddd277a7d1e1e41d0dfcd58cc910082753dd4da50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888954, "uuid": "bc02a719-190c-46d0-891d-80649355e222", "value": "T1C6C40217F7EC8022E4F11B7058F603C71A37BE616B38835B174AAE5619B31A4B27176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888954, "uuid": "46368234-d909-4fe5-8318-ed2b7ffcaa58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888954, "uuid": "37fd9cb9-2242-4d21-8942-b071b4c223c7", "value": "12288:yMrEy90Vz39SwC7jzxMakWO2r/+RVX4rqqA:GyGb9VC7jzRLtr/wervA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675888954, "uuid": "c8af9b8f-abbb-4e72-be41-9e848772a973", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675888954, "uuid": "47682d23-68ed-4911-b0b6-927fe3e880f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888954, "uuid": "0f92db4c-d17f-40e1-94e1-40aca93aed30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4132a1f5-a7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675880424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880424, "uuid": "8f7498c7-ebc9-4467-82de-32aa539be0f6", "comment": "Malware payload (RemcosRAT)", "value": "78092b8a72d068f981f3db3edd29ac6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880424, "uuid": "e7f2ad33-ae9b-4085-a986-1ccb8e36f69b", "comment": "Malware payload (RemcosRAT)", "value": "61878427cd1d8ae10265dc16cfa10444838db931e19429339fb5b7f44add7db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880424, "uuid": "4fce7e63-cb03-4402-897a-6fb6b83c5db4", "comment": "Malware payload (RemcosRAT)", "value": "55b22dbfb28a63564b4f5d227e1ddfc144119846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880424, "uuid": "0734be87-6254-475d-b271-07c3e7ed1e45", "comment": "Malware payload (RemcosRAT)", "value": "9c4f4e3a114d80f902c7c6159dbed599c2b78b971cb38aabb0f420a7e1607da8e9b56287aa5a0ea427e4f33ffd6614a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880424, "uuid": "a236b9fe-c1f4-4251-9d23-148afcb3c60e", "value": "T1C325CF1668D8C8BFD86CB6F2D927E4301D255DA948A3874EA5B476703071F9BDE0F82C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880424, "uuid": "77b49353-4cc3-4cdb-a71d-38cc6f087c82", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880424, "uuid": "b0b873a9-e6ce-4c78-87b1-25c5bd660434", "value": "24576:YuHL2plae9FplbpCsVQB2Qz8kSSyIrKcMB:telaeznVev8kJrKc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880424, "uuid": "9c30624c-e5c8-44d7-8655-ed5441980800", "value": 978000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880424, "uuid": "9278a4e1-e620-46b8-93a6-b99be923f33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880424, "uuid": "b04e4fcf-bde8-42d3-90ec-ec5df344171f", "value": "78092b8a72d068f981f3db3edd29ac6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbd5107-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1675882434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882434, "uuid": "cb914afe-6edd-4088-a2f9-fcfa22df38c6", "comment": "Malware payload (Fabookie)", "value": "0ab9a2b93ef9053ed55499c58929a158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882434, "uuid": "bcf6f355-1a40-424f-8968-b13501f2d9cc", "comment": "Malware payload (Fabookie)", "value": "61c7e6c115f4f051271f337205c02631b84f0c182f0e912395d533c78b14b632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882434, "uuid": "7f9b2d7e-40c6-4d2b-8c3b-71f7fe1bd379", "comment": "Malware payload (Fabookie)", "value": "7f76748d206ef93419b848f1f5e191d99dec68b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882434, "uuid": "0b49cd06-e0e0-43f6-a319-15852e09384b", "comment": "Malware payload (Fabookie)", "value": "71b93d164a18363c3676bcdf1ba07e7811584129931698976ef6e65ff6e4267b1a63dfd4b5b41d2e01dc9ba1c92b20b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882434, "uuid": "c0b3fbf3-1dbe-4c34-a83b-daf697321da7", "value": "T178B5336D39083BC8C41AC9748036FEC65659818E294DD5DE3ADEBE93BFE21D1C991B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882434, "uuid": "c29046d4-9717-4e6c-9abd-5c620a9debed", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882434, "uuid": "97e8bded-ed51-4e5f-ab64-2cb63bfcebff", "value": "49152:BWwplWTSE8RA+UvFIFYsIbpgxRlAlY0Ydq4a1xZcOQuU6BdleCylVQ:8gleOA+U9OYPQAY0YdNa1rcO7B9elW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882434, "uuid": "5d4712f4-ecb4-4ef4-b058-8ff30b3bdf2e", "value": 2488463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882434, "uuid": "baa61771-ad34-4faa-b88f-db1496d43e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882434, "uuid": "eded3914-b5d3-4649-8a82-1905edf94380", "value": "0ab9a2b93ef9053ed55499c58929a158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f343e678-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675883299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883299, "uuid": "53d58ef5-295a-4b2f-9088-1ad8417c53bf", "comment": "Malware payload (RedLineStealer)", "value": "c4d3f7d545fbaffbf484d735bfc4b51a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883299, "uuid": "0be266be-0707-44e8-86d6-fd1ea0954461", "comment": "Malware payload (RedLineStealer)", "value": "61cc936a614277a68df69e362235f9e8dacca29d0899865332722d204a50e920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883299, "uuid": "6d7f3648-3355-4df2-8ded-51177e5e6d33", "comment": "Malware payload (RedLineStealer)", "value": "1fbca74cf6748eb67c570703783756a71465981e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883299, "uuid": "60cfcc41-e3c7-46ed-a88f-01d398aa0cce", "comment": "Malware payload (RedLineStealer)", "value": "38ae4e36556e142f194e7b03d4dd958ba28ee4e3e3adb217c1f2526373b1d01c7f9dde1b4f0d72f11fd156709488689b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883299, "uuid": "bde2b1e2-c594-45c5-9aa4-8b6a726566d8", "value": "T19F945B03D3E17C82F9698B769E1FFBE8765DF5608E4AB7653228DA2B10F0172C163650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883299, "uuid": "8e38413e-c2d8-4e53-a16d-d0b2888d5f17", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883299, "uuid": "e0cb94af-6645-469a-b009-92f64a36af92", "value": "6144:nMErWLKcQHeNmuCIPNXrhdVp7emBcXUrYghsD4472LiqbJv:nL6IHeYuCIlXrrTCyYghsD44Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883299, "uuid": "f32f25b2-651b-408c-9987-1b640bca7e82", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883299, "uuid": "c462da8a-6dc5-4571-80fc-8b6c59707437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883299, "uuid": "2ffa7c1c-5d71-4764-b650-d4af52054688", "value": "c4d3f7d545fbaffbf484d735bfc4b51a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d285a5dd-a78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675845449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845449, "uuid": "4b283948-f13f-4d78-8bd4-11e320832030", "comment": "Malware payload (AgentTesla)", "value": "e64dc6a28bb4fff044e8c2b391afb9ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845449, "uuid": "5e940c8f-176d-4a57-864e-3a8d5b28ca68", "comment": "Malware payload (AgentTesla)", "value": "62744869512ea09a336541d896d45f1b6b5a298073376f477d92a99a93452d78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845449, "uuid": "b39006fd-2445-48db-849e-b91fabea5b29", "comment": "Malware payload (AgentTesla)", "value": "daa68530ea18722c559e9ed38ce3124653e94651", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845449, "uuid": "efaa95fa-2ae0-4862-9373-9a9d1c91e0ec", "comment": "Malware payload (AgentTesla)", "value": "339a83aae2f0487e63f6e430cc3abab84f37a747f5168b472e2678c28377dc5751b7bfbbf6149ebaceae3d66bdbe5e8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845449, "uuid": "38556ff5-8d05-49dd-a0f8-98ddf4baa3f3", "value": "T141A4238064C4478ECB2F4E7A72AA347ECFD04354542EC26F5A9BE10AF8176953C15DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845449, "uuid": "8d2c5f79-4195-4aba-9ab2-7cb919e4375b", "value": "12288:UXfmft1JIl/CqbavtE4XH3qpkz/ePckg+E:rt1w/CXwvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845449, "uuid": "b4b42ecd-f516-493e-90ca-55f1c4606c5c", "value": 486246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845449, "uuid": "4e469ddf-a0cd-4c11-87a5-58de63de180c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845449, "uuid": "d14be743-a864-475c-a192-07a6e1baed18", "value": "PI 20484-234 Qinum.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea91dcd-a7ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675888204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888204, "uuid": "2223f882-bd09-4ad2-8992-aeca04c76801", "comment": "Malware payload", "value": "0075b0c25925ef4c22a38448e46cdf4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888204, "uuid": "fa9c8035-424a-48a7-bbf0-f2536bd57092", "comment": "Malware payload", "value": "62c632190aa02ffe1b76a7c585c8f10bd5ef1dfef443f2fabcc94a05c6a48c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888204, "uuid": "93ebe35b-ab9f-4cb2-b557-f77f2cb00e95", "comment": "Malware payload", "value": "e23246878c644897d1ac712e8ac79ec20f231c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888204, "uuid": "4e2a6fa7-25b5-490a-92ba-f57cc42db07d", "comment": "Malware payload", "value": "f90d76e9c11426297737ee7afbfb9528d78fdefc22eb472b3ab060990efe13cc0d0d37ad7cdcf5928a58947506d0cae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888204, "uuid": "20829552-e80a-4ae1-bb9e-67a2c8a449d1", "value": "T11BC41207F6EE8023E5B4277018F603C3193A7DA12B399397574FAD2A1D731A4A23176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888204, "uuid": "0e7efdd9-74c0-48c6-8cde-fd5d72285cc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888204, "uuid": "5b611484-37da-40d0-a3d7-12d1a052174c", "value": "12288:XMr7y90B6GP9OpLATCbnMCkWO4r/+3ZM4KBX2mlxfZ2Zi:Iyy689ORAGPLBr/WbKBmml9Z+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675888204, "uuid": "13e22202-3c53-4d60-af70-7d56d6c0e133", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675888204, "uuid": "0cd0ae5d-9ace-4959-b58b-9c832a2b9a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888204, "uuid": "5b00cb59-f772-4419-beda-60e4ec98bd0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793ad7d1-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880947, "uuid": "dfe4d9a2-6a76-4ce5-a249-1f4b508cec42", "comment": "Malware payload (SnakeKeylogger)", "value": "2834accae90c855e08aa35256904d6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880947, "uuid": "1d8fdae1-48bf-4c2e-bafb-70453196c1c5", "comment": "Malware payload (SnakeKeylogger)", "value": "6335ab176fb7366d390685a682cdf1a75bec8e450fe1cb0ce278854d26e8a68a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880947, "uuid": "d23a41ac-23f5-45ae-8b71-29dd081e010b", "comment": "Malware payload (SnakeKeylogger)", "value": "7190a9aaaed3186491b75c10e12f5e4fb11c1bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880947, "uuid": "97e0880f-7ce0-4557-a673-b4bf8a225dda", "comment": "Malware payload (SnakeKeylogger)", "value": "feee6a6b96c241a784e76c5bbfcc1f8a85d6bae57edee1defa1d7a675eb142edf926fbcc86e342b46a263111f4e96b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880947, "uuid": "771d8362-070a-4531-b851-cad4fbfe993e", "value": "T1B835A7203AEE501EF1B3AF7A9EE4758B9EAFFA63760694492054034A0B13B41DDD153F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880947, "uuid": "dec985f2-299e-449c-b6ff-b949bdd885f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880947, "uuid": "2698eb00-a9c3-4751-ada7-725ed9f303fb", "value": "12288:yDdNuif+9gLHHPrpg6+R4cSbEX7ULxMtA46AvJQjb9S03Tb96vDD/fB1VmVl0b3C:sNuiWGLHHPrpg6+R4BSZLTwjBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880947, "uuid": "1f7d1f2b-e46a-449e-b2d0-a2d635d36130", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880947, "uuid": "115199ea-909d-48b2-a039-a17f5483362a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880947, "uuid": "262a29f6-626a-423b-9f16-90f657496897", "value": "PO 00292002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce6acaa-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675854029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854029, "uuid": "77e03aae-7a7d-42c4-a920-2225e0934d8f", "comment": "Malware payload (GCleaner)", "value": "22bf4232c0bdcafe811eaa2d40ad957c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854029, "uuid": "f314df78-5fe7-4f4f-9bfb-f631a04dad74", "comment": "Malware payload (GCleaner)", "value": "64276346520993b47723b5dc664e59058bbd8cf31f54d4dd96800a7803a923b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854029, "uuid": "0c55dade-07a7-455e-ad7c-81223d627bc4", "comment": "Malware payload (GCleaner)", "value": "ef7ac3a1566e260c316bb6580aaae6041cf3d89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854029, "uuid": "581dc369-3a02-4b61-bda5-c2c60d190def", "comment": "Malware payload (GCleaner)", "value": "d71996e8b2cf0e333d01f2fa6ba4325e8fef911ccbca06e005aa8a2e4439f70132b06961a9901c1d1512a62c79853947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854029, "uuid": "003ab662-14be-4c0a-bba2-ce614cb59e38", "value": "T160C5127C7145C4ADC290FEB48C2A98E75CDA6DE3D8D4A02770DDBF3F51B92888A1A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854029, "uuid": "ea84b0d9-2c63-465c-bea4-98b4d54d1c03", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854029, "uuid": "47345415-e7fa-4ff1-99db-0462506a4438", "value": "49152:rdHBM1OzA5D7xppMiTQCt9fhcT9KykmRH1DzklXC+LCgv2MR:JHBM1OsplHMiTHLcZsqH1vCSev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854029, "uuid": "22d69cc5-5be6-49ab-938c-3e9df7b26b03", "value": 2716012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854029, "uuid": "bc380559-2081-45aa-ac7e-7815b3460ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854029, "uuid": "fc01bd4f-300d-49e7-910f-c7303674ee8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9b1d73-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675881486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881486, "uuid": "9cdcd08a-25dd-494e-baee-5e810f928d81", "comment": "Malware payload (Vjw0rm)", "value": "08ec6390255e658106aac7aae7114b6c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881486, "uuid": "bfa34471-e811-41a5-a743-cab95bb25297", "comment": "Malware payload (Vjw0rm)", "value": "64394d6cb0b1ac69cddc943ae96e755184d20a60428372e24e0df466c2debfa9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881486, "uuid": "798a9761-494a-47ce-8b9d-b1a460586bb8", "comment": "Malware payload (Vjw0rm)", "value": "b8f85e4daf4461f6ee5c69ff95bc51c24b33fff0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881486, "uuid": "a6ccc06e-1511-4239-a588-50b157a21d3f", "comment": "Malware payload (Vjw0rm)", "value": "3f082eae58281e70b18b520dec7d752d208a26d5ae193db3178ba011c2b0ea9b46ee0a220fcce8e705494d3d22dfa7ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881486, "uuid": "5745e236-184c-4c8a-9675-abff53230c98", "value": "T1452634B0776CF5675FB80F0EB2EB1D8D5EE1360F8CD170A8521AAE2F553A984098D4E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881486, "uuid": "3660d2e5-0bd3-4c90-b746-5e69d8c2c050", "value": "24576:rDg0p0xod7eN0L23S6z4/WBXVFbPUzgvQ/vZSoKJ6hU:18N0IZTBnbPe1KJ6hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881486, "uuid": "b6879008-3e2d-4378-ac2d-12c85c250395", "value": 4623276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881486, "uuid": "7358d85e-e450-44bc-9999-644aea5ec06d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881486, "uuid": "f5cb00a4-1328-4677-b246-3c135b03e28a", "value": "SOA and invoices.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60234487-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675846975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846975, "uuid": "ca42a501-4c13-4680-b83b-c429a95d99da", "comment": "Malware payload (Amadey)", "value": "0d450dfce46a8ae1aa0c1d9ae226cbee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846975, "uuid": "6d0ca8eb-72b4-4fac-8ac8-339f50523a42", "comment": "Malware payload (Amadey)", "value": "64407ba117f8138073333e76a931b3ddee8bde408ed0a024dd15c8114b913354", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846975, "uuid": "4aac7484-d679-4fa5-906a-6d017c0738fc", "comment": "Malware payload (Amadey)", "value": "f4b57bac1ea70f1d07af883adc90a943ccdc70e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846975, "uuid": "0c8a0c52-272f-482b-bc44-7a565e8457d3", "comment": "Malware payload (Amadey)", "value": "466b642fa91ddff82ded53396d2e37d4f10139d548b723022be7ac5d58b7717da21a138b7f6d0d303cfdd5e97663fde1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846975, "uuid": "22f97d0f-7ccc-4f2d-8d7a-750d69ff50ad", "value": "T1EBC4120BF7EC4032E8B25B7019F703C31A367E511A39829B276B5D591C726E4A63537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846975, "uuid": "d9e8b000-d157-4566-a60a-093931feff6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846975, "uuid": "41698cf6-f248-4369-87fd-c85dddb92a66", "value": "12288:GMrDy90rE1VcJtL+Ef9fMYDe4uzqk+qtD/Mnz6MgM35YkgO:dyCEVcL5f9kY7SrDgVgg5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846975, "uuid": "57bd1982-f323-4b7f-8789-1ca6e4ca4975", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846975, "uuid": "e150e3c1-4674-467e-8bf6-b265adccf231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846975, "uuid": "fa6b6462-2821-47b8-aad9-6cf9c1f224da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913055b6-a79e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675853500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853500, "uuid": "4bab5b59-6bc7-4599-b4bb-6da606175f34", "comment": "Malware payload (Formbook)", "value": "917268c3f223d515c1a9bb46d089ef1a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853500, "uuid": "aaa2dc21-c0d9-45ae-b82f-1063e3b5dda9", "comment": "Malware payload (Formbook)", "value": "64d52c04daf4777bc001c3d61565bf659dd1a35cfa776ffae61ee0642a3e53ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853500, "uuid": "828da138-0947-4323-9aea-d346f208dbcb", "comment": "Malware payload (Formbook)", "value": "71ea30d620abb7a03d551a8b02a1a7edd4cc468e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853500, "uuid": "7ae019fb-55c6-402b-9a90-798feddcc1cc", "comment": "Malware payload (Formbook)", "value": "9418b4be5ea1aa8359dba8308ec0194582c106ea370aa6a76dc3f0b892dd9811c85361433b5886b48dbed53db7963d34", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853500, "uuid": "03c148e4-fb4a-412e-b77a-f471d97996a6", "value": "T1906423F491D96C99431F9A69052CC71B6BB80044B9263F09BFF9B4BEB6287CCC1D9D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853500, "uuid": "d85bf665-4702-449e-b869-4692f7a05d87", "value": "6144:pck+QxgRs0AnKMaikHdSuYH9YGw7/b85GDXJYqv9kZiWXIeJre:fe60eKNrTjGwjA5q559kZ5XIeJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853500, "uuid": "04c56dc2-5796-4969-8d85-51d353a55f92", "value": 335104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853500, "uuid": "45f17623-e813-45f4-a22c-d3ad855d98f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853500, "uuid": "d3a25e1e-9c41-449f-956d-b7348f6058a5", "value": "TRANSFER CONFIRMATION_PDF.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a8bd68-a796-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675850120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850120, "uuid": "bdb91143-ccad-4c03-bb1f-faeec5c1562a", "comment": "Malware payload (RedLineStealer)", "value": "63d5793344531a514dafcfd6eb28375d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850120, "uuid": "8a334db9-1815-4964-b557-a69cdacebd52", "comment": "Malware payload (RedLineStealer)", "value": "650b2e125bccc27722eac6bd28619cfc2e75ed1a820e921c9544282514626c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850120, "uuid": "97cb9d4f-c343-40bc-8920-c1da7d47391b", "comment": "Malware payload (RedLineStealer)", "value": "15d9d2969e6630da46ec137285a022fa7c83dde9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850120, "uuid": "e2ff20fb-16bb-43f3-9407-e15067aa7097", "comment": "Malware payload (RedLineStealer)", "value": "e3b7ef356cdd901e3ad1ee26416fe5923393559eecfb6ee7ea050bd4f5480e20e182f47e22cc54895d5b232d86c6da81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850120, "uuid": "b0556d97-ca09-489c-9e46-c2b9fe6df140", "value": "T152D3F14443F4CA62CAAF6D39B7F482035BB1FB172A23DB5F1D8D51D509A378098607AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850120, "uuid": "5de29d30-3a15-4e3c-a570-8d5d0496a31a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850120, "uuid": "336fdf56-a7c5-4cb9-8c67-7cb19260e380", "value": "3072:l1Jsg86QHio2dluSQHPl3HXVs24s0ulifX/6VN4:l0+QCo2dfQHPl33stfX/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850120, "uuid": "25bd74df-c5b9-4022-81e2-708c62bc35cd", "value": 136304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850120, "uuid": "6198ef20-cad6-41e8-a514-9c51a34a295d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850120, "uuid": "35978e5c-f31e-44c2-98bb-bd4ee7c1f18b", "value": "650B2E125BCCC27722EAC6BD28619CFC2E75ED1A820E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17a3b14-a787-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675843648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843648, "uuid": "10d12525-7ea7-43eb-a61e-f2253c8c1715", "comment": "Malware payload (Amadey)", "value": "5d9305c4904efe004edb8797b463bd7d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843648, "uuid": "2d47fd40-a504-46ff-a925-97638c0fb210", "comment": "Malware payload (Amadey)", "value": "65b045a5931557d8809c43321c764f0ab4959bcc84f5a3d5e49cf5956e590aa7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843648, "uuid": "a2ce864f-7a33-448e-967d-bb49bf6cba34", "comment": "Malware payload (Amadey)", "value": "7539f7f6c2f9ed54828f9d99c081191b06291128", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843648, "uuid": "f6266b11-a31e-4e46-a63a-eb5a65403159", "comment": "Malware payload (Amadey)", "value": "aa287793226692e6f0c543dc4895b22808cdf645c88c2021dd1956e2554c7664768e5817e1b02f706a2fc5504d808b6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843648, "uuid": "786c00f7-5c9f-4a24-b909-ae42610e3742", "value": "T15DC4021BB3FC9472ECB557700CF202E31637BEA15A34839B674B686A18726A07635377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843648, "uuid": "91b3d5d1-1786-415a-8604-60448fb825e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843648, "uuid": "8bfc5278-52b5-498f-a3b3-81d885dbcb61", "value": "12288:qMr+y906xeVV2MmK6PlmplI1QHxdPSruVsJOgsBKKppz:IyGVV396KI1QzPzVsJUBNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843648, "uuid": "ef5bf32e-dd16-49de-ba56-a52aa4d9ef16", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843648, "uuid": "2632f76d-5065-49e0-a9ea-4d42b1cb6265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843648, "uuid": "b5e38a4c-51a4-4120-bdc3-ca73e35c7e88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9883d398-a758-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675823447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823447, "uuid": "076a12f6-791f-4068-868e-0c839b422b73", "comment": "Malware payload", "value": "cf5e9414dd85889fcd08aac95b87bd44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823447, "uuid": "c493c05e-3658-49b5-9fc9-9f2cc0505c27", "comment": "Malware payload", "value": "65d64511e628e7a0b67944554608ae5fb403c07bb1ad2024ebc665a006ab41aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823447, "uuid": "b5b955d7-3cad-49a4-a895-baafa513cc1f", "comment": "Malware payload", "value": "5de5c31df0fbe37b60446261bd8639b7d3d36c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823447, "uuid": "df902b44-c8e4-42eb-bec1-16a09de07b24", "comment": "Malware payload", "value": "e716f3ec766461a05f5c2eff045b1dac58af9f8445644f97ece536271d0ec038bad7306fed47a0caaf96cd50131c59dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823447, "uuid": "877dbbcf-007c-4113-ba14-d13ccc3c912d", "value": "T1B17633103B90CD76C0925137822B784AE4B7FA478D31EE17B349852F586DE89AB35B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823447, "uuid": "1a06ff5f-a9e8-46ee-a667-cbfe4d09e2f4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823447, "uuid": "eadd00bd-f766-4818-bb2b-8e1721380130", "value": "196608:91Oimrn141juDzX4zysCeGC9vDR5LBt8UD4l8Qc7KG:3Oimq1juHXrsv9vDR5Lv4llKKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823447, "uuid": "3004d3d2-706a-40f5-9d69-5b302a3b3789", "value": 7651151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823447, "uuid": "9917e481-d7f5-4be5-817a-9dc38a8bfdfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823447, "uuid": "9d4b2f55-16cd-488f-bd72-b94efc7fc6ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9544a0-a7c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675869140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869140, "uuid": "304ac805-a00a-443e-ae55-d7aaa354790d", "comment": "Malware payload (IcedID)", "value": "833193115b21757cfd256bcb064c5a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869140, "uuid": "12c9674e-68fa-468e-bd78-76f33f1c8694", "comment": "Malware payload (IcedID)", "value": "66241149fd6ac0ec6bac32141748a8b5a1b0cd1610bd2687cae0c2cfa671945f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869140, "uuid": "8b4994cb-e347-4bd6-898f-37600c51f904", "comment": "Malware payload (IcedID)", "value": "62c298381030c807e79ba788b35da39c9ec9eff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869140, "uuid": "0a18fac2-6010-4f16-996c-ab05a79c1fea", "comment": "Malware payload (IcedID)", "value": "7bd3b6a9282b585fc3b4abf9a6d2c66847fddd725fbf412e1541ddef1a574591ea0f8a3dba7224320d0db283d56cdfbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869140, "uuid": "3bc1e8b2-b3ef-4ff2-bcb5-4b020bcf97db", "value": "T14E646B09B2A550F8E173A13C89675906D7F2F8254770DAEF13B0421A7F377D0AA3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869140, "uuid": "614b4161-8f2e-416a-942a-fb0083110cd1", "value": "54274b0fcb0b5b59b8f4717640e7cdaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869140, "uuid": "3025758d-63c9-4d64-9de2-afdea0f730d1", "value": "6144:vY8Rf3XeWBNjIAo1SnT/QTULpFZohRIas:vY8RveWBNjwsT/QioT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869140, "uuid": "8b75ab1c-b1b1-46c7-acb8-17fbd9311bd0", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869140, "uuid": "12c9415b-3c4c-4fca-a92a-37f701d0d54d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869140, "uuid": "a530c081-6a37-46f0-81dd-15846158c0b7", "value": "apple.png.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c2783e-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881190, "uuid": "59272be8-ee10-4cd4-a381-afc1a43c8214", "comment": "Malware payload", "value": "15235cb2697dd290c1976dd31f10fc44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881190, "uuid": "15649126-f021-481d-adb4-6ad6a3389b47", "comment": "Malware payload", "value": "6643176655f6e1dd356f5b827bc80ad2de499434717c8d78dd36a2110fed5657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881190, "uuid": "f43e09f7-27e1-477b-9727-e01c6e92aeae", "comment": "Malware payload", "value": "00dc8836fd8b9fbab69419c19c2bcf998224cbf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881190, "uuid": "4c27185b-41bd-4386-875c-12aad33e2124", "comment": "Malware payload", "value": "888814d5002d1b875e676f753e5432ceca4b63965f4a3175faeb371310f55d759213f5e96d40e2361d7637db5d29d7f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881190, "uuid": "e0083207-093b-4c6b-8472-08e048dac25e", "value": "T12F95AB0211DAC02AE017B9FC5C55E5BCA93A5611926C4FE7A2B03C4613F9FDCCC69E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881190, "uuid": "224cb694-7014-438a-a987-6747909a95f2", "value": "61ad665502ca1c66fbbbb4bc3ca6cb32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881190, "uuid": "cc63baa7-58ec-4df5-87cb-2c562da0fce4", "value": "49152:LXJMezxMw6mUvPJCgbffRdvYMFE64Nx7mQfUsc:lMezxWrNbnRdwgE6ohmQf5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881190, "uuid": "5b88f3bb-a0e7-489b-9fd4-df6d839db8ed", "value": 1924240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881190, "uuid": "153e4d76-106e-487e-a59d-7727bc869534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881190, "uuid": "2df9d954-e3bd-4958-84a0-5f0cc1983b89", "value": "15235cb2697dd290c1976dd31f10fc44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1e485f-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893438, "uuid": "b99a8ac1-44a4-49f4-9793-0163b1a4e5e8", "comment": "Malware payload", "value": "c3fa40305ff0673c8bb005da3e06a666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893438, "uuid": "aa937d62-0f87-493c-9ff6-933e353b0554", "comment": "Malware payload", "value": "66bdde9f427859cc6b7cc1ff67bdf9d93ff8b0d7bc226185cb2195c746e28a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893438, "uuid": "fe777cb9-1227-4615-9162-7fcc18be1669", "comment": "Malware payload", "value": "041364fdce3b61225d33d9c15adacde47f631bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893438, "uuid": "85b1948d-cbae-4d11-9cde-38a7eaac91c7", "comment": "Malware payload", "value": "390a9c3a6fa3b376ce7f8cd9041c1b22b9a733dc8a8d8d75fb9c2fbc96f1f3ae7fb48edfd07da1425f8387aecb22869c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893438, "uuid": "6ac97e6d-b42b-4bd8-b08f-fd052fc4d015", "value": "T115F38CA3B144D2A7D8654271F857D4F30663FF2ED9A0151B229F7E0DBBB2372012662B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893438, "uuid": "6ef96997-b9fb-4dab-80a0-3e3b126b2319", "value": "3072:x+/6iISRO+z+t/6rXmECSn4sfZIOwfW191U6QAyDBptgBwZ1B6e6Ph:xzcO+zQ2XmEn4s2DBptgBcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893438, "uuid": "455225b0-31e4-42f7-b053-b3fdb5ff4c9f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893438, "uuid": "62efbb5a-ebd1-429e-a6ac-f2c4eecd5717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893438, "uuid": "2b27560e-ede0-4c89-af4b-602fcfa90179", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3316960f-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675858925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858925, "uuid": "95dff7b3-bad2-4c4c-bc57-00c23c61e3bf", "comment": "Malware payload (Mirai)", "value": "c7793d2fdb4165caa87fdb9a9024c870", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858925, "uuid": "86c68496-ce4d-4ce6-9a05-e0cbd5f00cc3", "comment": "Malware payload (Mirai)", "value": "66d77c29ea15fa9eaa02d44b4cde9fe5b56b022639d439a7649747c90f52a170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858925, "uuid": "1b50164a-3bb8-49a0-b29d-f1bfddaefe64", "comment": "Malware payload (Mirai)", "value": "95b2dc3bfcb792d67fd5199bd2ab9754cf8617c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858925, "uuid": "15197a2c-edf4-4576-b607-c9878ef5fa7b", "comment": "Malware payload (Mirai)", "value": "af1548ae31b1735977fa259069e507cceff1784ed18d172a7dccf1c516ed8ab587877697011752497373a7ff9152e746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858925, "uuid": "7b96c9ff-89be-4eec-9acd-e13e2a856275", "value": "T1FCF2F1410269A8B0CFF1343AD990868C69A46F78C4EB79732B945FA853C3DD550F66C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858925, "uuid": "983d155f-57bc-4afe-ba82-11c5db49a77a", "value": "768:03+DJkDgl/Ynl6erpE+veqklip3BA9q3UELQQ:2+KIYnl6er6+Vk0pL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858925, "uuid": "fff111b6-67b8-4b64-ad30-0130a0e5ff9b", "value": 34496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858925, "uuid": "7849e085-6b50-4469-b8af-f2faa62009cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858925, "uuid": "d014d541-2082-4713-afcc-b8bc34846eb0", "value": "c7793d2fdb4165caa87fdb9a9024c870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f33959-a783-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675841720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841720, "uuid": "9b1d277e-bd8d-4b2f-bda1-8af1366dc374", "comment": "Malware payload (AveMariaRAT)", "value": "c0c37fc1cd8f4df3db73cb04591b3158", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841720, "uuid": "ea5b5469-75cc-4d4f-b597-ceef358bf2a0", "comment": "Malware payload (AveMariaRAT)", "value": "66f870824ac16c87c82cd98234a146bbd2963ffe01a7bfef00cc2d0c8d8356cc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841720, "uuid": "47a43ca7-25be-4c3b-8277-f7c0104d1c8c", "comment": "Malware payload (AveMariaRAT)", "value": "bd947aab03c4d50ab8ae66c6cdf1a9d8fcd9efb9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841720, "uuid": "ca60d84a-3601-4079-b76f-28a284167fad", "comment": "Malware payload (AveMariaRAT)", "value": "229d2e6c467278f64b1c3696a524996cc72d548445b159bf293fe6dbd60304bd1c7be29b539feb232c13aa4e26143fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841720, "uuid": "50cf37cd-3e57-4644-9c75-89d34f5f49e7", "value": "T18A15AD13739CDB4ED1A542B86972DBA02367AE3B90A0EED479C1BCCE0531B5879076C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841720, "uuid": "ad23618a-c267-4bff-8f7c-ebf73cf09bb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841720, "uuid": "6024490d-5705-4af0-aa79-54d434fced9d", "value": "12288:a3WlV/DfrpszP4M/Qe0iId1ltMq+LwNFCXCuqdhYNWf3yTW41KCdsaiHdH6hv:plpDTpWwMYeqaqVFCihY43+W4ivdHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675841720, "uuid": "59aa3431-088f-4941-bb27-893c23bd6130", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675841720, "uuid": "ec164cbb-dac0-4b50-af80-6b9c9d31634b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841720, "uuid": "182c5bb6-a7da-4d5f-a893-94208e21f67b", "value": "Invoice for payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c41eddb-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675882160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882160, "uuid": "bd0410fe-1ef6-4518-98a5-c15702a6bf77", "comment": "Malware payload", "value": "82a740e8bca6d24877f7cbf263fddaa1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882160, "uuid": "26b49fa9-8f59-404a-bdc1-7f6268ac25ef", "comment": "Malware payload", "value": "672a9e0f2f6fa25d2d748d0d8f44b65962a4be004df05cfd361835d892bd533a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882160, "uuid": "59e16eef-b0de-4013-accf-193ce8abdabc", "comment": "Malware payload", "value": "536496c4017a95cfff0226ef1212a8c01862baad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882160, "uuid": "8018cf79-fa46-4290-bbc6-c1c3634eb4c9", "comment": "Malware payload", "value": "25f6146863ad7d6a53a3828e334ba40e14aed5b9e26354047161c411cdb33fd1a24580f6a02ce991165f7ce8964dcbde", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882160, "uuid": "953630e0-3b6f-46ef-9178-0f49a7253a99", "value": "T1E785BEB876047DE62A6F576BCE96ACDC13B617239ACB94CD80647BC305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882160, "uuid": "2d19ba56-2c3e-4213-a178-ddf14b56de37", "value": "24576:thwCRRlW5IQUzYsbteMGfkfzhF1ee8la65bmYS3O7kCMNYc1JBStYG8TOl97JkXk:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882160, "uuid": "9df69a84-451f-478d-a7f8-2b0f01a0eb21", "value": 1843711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882160, "uuid": "28eeeacf-b0de-423b-8ddf-cbbee45faa48", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882160, "uuid": "7b3370f5-5ebd-4631-8891-39ca3a3911fa", "value": "P.O 2302000006.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122071da-a7f4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890223, "uuid": "7398b77e-2501-4bb1-8d92-fcc607210cc8", "comment": "Malware payload", "value": "63d815b02c7987181a6ff1ec556506b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890223, "uuid": "ed890b4f-c68c-4690-9404-077c8de340a6", "comment": "Malware payload", "value": "67c4688e49e3e2edf80045f79a272ab704fdc5a95e966ba5f54b386822b00f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890223, "uuid": "7c7674b4-f43b-4052-9f19-6fb6889b7f7b", "comment": "Malware payload", "value": "7c1b02d1a1e74c2103b439c8a355ccf473baf99d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890223, "uuid": "eb96757d-055a-4078-bc9b-b01a176b8c8f", "comment": "Malware payload", "value": "26566a769c35eead850185076c24579da8ca53acdfb00e05ec6dc9d849016e42f27d0b10d94b0afd48128f7c816b1d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890223, "uuid": "73d9f8d9-f7b7-45ab-9ffb-6fecf11b652c", "value": "T1DBC41207E7ED9073E8B1577019F702C30636BE506638935B238F6D5E09B26A4BA3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890223, "uuid": "0553b96b-a5c4-4b0a-a0e5-b8aa7877b97d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890223, "uuid": "bf669a3c-2344-4b5a-aa60-963a75e7a3b4", "value": "12288:nMrJy90O6Hh1Nyaw3I+at22rDS30igZmPB9IN8Zgx/o1vG:6ynKh1Nya7Zt27B9LCw1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890223, "uuid": "630ffa39-9cf1-4f55-a49a-0a578d066455", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890223, "uuid": "c02e192d-18de-4721-94e6-220759b1e6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890223, "uuid": "be47226c-6d7a-4d64-b39a-4066d9bca39f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3571da3c-a7eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886417, "uuid": "8d6c85ef-e70b-4fde-91f9-4777df23eb15", "comment": "Malware payload", "value": "59ac1cfddea69fa213b747faad3f0f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886417, "uuid": "1bfcec06-aa31-4c32-9910-8859dcd4acab", "comment": "Malware payload", "value": "67fc25f92a3074fe21704051a8aa72d438d5a06030cc7630db7e95953a998c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886417, "uuid": "27b864b4-21e4-475e-bd93-054f7d3c966a", "comment": "Malware payload", "value": "a7a2a21106b999828444ad16265ff339a2775f99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886417, "uuid": "282a3340-f515-46e6-8eb5-32a764cf3b70", "comment": "Malware payload", "value": "7deb1a189afdad9874cbbab9adaa6c84f1b6d778c73ca22445e19d6cf9f8adda0da3b0b2b84610adcf596690c00b1827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886417, "uuid": "d1f8f82b-9380-4449-b3ac-c641e3f0b756", "value": "T1E2D40168FB20E80BD9560B781C95D5A45930BE802C64C513B7E37FAF7F3A6D3B919089", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886417, "uuid": "abe00d63-72f9-47dd-83e2-7a0db23e725a", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886417, "uuid": "f922b153-0fd4-4e5c-a163-90b48d6212e1", "value": "12288:lbif/mHZzu6uhuQgRN6Zuj90Z2upnDgy/HE0P3Q8x78IV7tc4NCp:Rif/mHZzutuQgHt90TnDgck0ILI1tco0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886417, "uuid": "7a91ea6c-e41f-492f-aa3e-e1fa9da870d0", "value": 631040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886417, "uuid": "a2150a45-1d62-4430-b906-46064479b735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886417, "uuid": "960c9b80-c8ec-4d5c-ba01-f12256be9594", "value": "Rechnungen-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b85417a-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675819828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819828, "uuid": "e4a897e7-1c49-47b9-8b18-a5bb4ab57910", "comment": "Malware payload (GCleaner)", "value": "00dd47c2c6222963cf6c5a5aab4b7777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819828, "uuid": "efec8b27-e912-4c72-897d-6877c48e72d5", "comment": "Malware payload (GCleaner)", "value": "68141f1acd61d920552ef107d9e68f9ee435b814537c21b36350b2cf06416e3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819828, "uuid": "9ee41a76-47b9-4e60-8571-482ae8250f86", "comment": "Malware payload (GCleaner)", "value": "84149447bca3967b033054be05098ba2490a1d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819828, "uuid": "bdfebe9f-988f-4c52-b8b3-2cbffc56c89d", "comment": "Malware payload (GCleaner)", "value": "8e56b8e14cf4b281a24a1c77009651fe23bdb496eed4e2b13e38f3636408e3bb1026e9d5356666a52c30ccf4e09bbff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819828, "uuid": "61541a22-a572-43c1-a60c-7624f3dfb962", "value": "T1B1D5F00A1C98D0A7D1618F70C8D76DFA8C16DE6FE8BB109712147FFAB631606E84AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819828, "uuid": "4117ea52-367c-4e54-a919-7b12570bc2d1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819828, "uuid": "fb6f28b9-cc8b-4f14-9f69-452b36bd345d", "value": "49152:wDMfbMWlshtOp50iU7tjH4Ecx2HnWEFnjzCpKkPKyhDp8DRlue8FcwQ+csFLCgvV:+MfbMO0Op50FLO2HWq6pKZy3u2eqQTs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819828, "uuid": "df0fd949-5b3b-4da4-b73d-fd66a4f4f0c0", "value": 2769408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819828, "uuid": "fc826fb4-66a7-40e6-9d2b-f6c773792a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819828, "uuid": "809011ef-b6ab-4bfc-bf93-6a3bd41c2787", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc7ad72-a7a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675855349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855349, "uuid": "6329a602-5980-45e9-8d59-4045b891c2d7", "comment": "Malware payload (RemcosRAT)", "value": "1d5d989ef5a4bf7710c6f985c54341c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855349, "uuid": "1986a465-3918-41d8-ad6f-1f45bfd0c19d", "comment": "Malware payload (RemcosRAT)", "value": "6835204494304ed36d6cbe1cd90abb1f31d9cc88fdbd374e29ce59af0a155cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855349, "uuid": "b2e8955b-b996-4680-bc0c-ee8c8ba72d0f", "comment": "Malware payload (RemcosRAT)", "value": "35d55d49929a6c6bf3a76fd889870074bb1f6c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855349, "uuid": "c612a3d7-355b-46e7-a28a-7b0561d644fd", "comment": "Malware payload (RemcosRAT)", "value": "65167615866837500cfc5749f27febfb6381c6b50c80378738fd33413afff40dd1fe2e5b237820214bb2c8ba2ca7f336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855349, "uuid": "34833834-145a-4190-891f-e5903cab4bf9", "value": "T10D75A3203EFA502AF1B3EF755EE475969E6FF6633B07A45E1051038A0A23F40DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855349, "uuid": "736812a8-a035-4496-9d28-1f8259d59f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855349, "uuid": "b2d7ab9f-cc7a-4834-8578-b2325c2c1abd", "value": "24576:fEDtXTeUjECj5Eg3dgQq2luyGzFegLpgO9W7vO4vx8byGU1f1:YECp4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855349, "uuid": "defb1bb1-69c2-4526-96f2-346ae388c519", "value": 1700864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855349, "uuid": "4da06d03-f734-4c2e-b202-2255b8c394b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855349, "uuid": "bed43ce4-d269-48ae-981b-a2d5b86a3afc", "value": "6835204494304ed36d6cbe1cd90abb1f31d9cc88fdbd374e29ce59af0a155cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0ee40b-a763-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675828068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828068, "uuid": "1edb4ff0-9fcb-4756-8a09-b30d0d9c279c", "comment": "Malware payload (Amadey)", "value": "e6d5c26b27aef04f8b97970f16f89557", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828068, "uuid": "98e8bd38-10b4-4abe-b481-c79136a338e8", "comment": "Malware payload (Amadey)", "value": "683e593613f41a8efd5fea173cb3cccb8a606544297bb19e6139a56f5483cedb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828068, "uuid": "d5d4bea9-4d89-4687-a410-aac59ae9c823", "comment": "Malware payload (Amadey)", "value": "4fd5320f934e031b8b56ddc034057dbdac18e47f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828068, "uuid": "cb90704b-4b6a-4cb4-99cb-803021da6884", "comment": "Malware payload (Amadey)", "value": "ad7b1cc03c1115f687de38f092286100994e22594a0ead5cd377c86a2a7a45a7d244ed347ee64b93531a5dfa2bfe26ca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828068, "uuid": "b24d601d-f7f9-4f59-b1b1-834848c9fe90", "value": "T1DEB4020BEBEC8031E8B5277019F607D3193B7E615A398767235B281A1973AB4B53533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828068, "uuid": "d0b0107d-e223-4818-a3f5-32672c28ef5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828068, "uuid": "c21d3cdd-6884-434a-840b-7352921f350f", "value": "12288:rMrvy90LNJLwVKGNjiuM/y9oo+64mIfnBhE8Chfn1:cyS38VXpEy2oJ4mIhE8Kfn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675828068, "uuid": "17387001-1824-46d1-a46d-9dc4eba3652c", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675828068, "uuid": "5fdabd8d-bab5-406f-9259-4d295f2f0358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828068, "uuid": "2144d625-4e3e-4d6c-864f-c58b3a99131f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca9f18c-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675882054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882054, "uuid": "f0b01537-285d-4e1e-8f94-c05e06eb7cb8", "comment": "Malware payload (AgentTesla)", "value": "fd11a36ab0ef1b5345eef087f2f2d55f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882054, "uuid": "1831f3ca-b3e4-4abe-88f2-113089278213", "comment": "Malware payload (AgentTesla)", "value": "683e6029dc611cc7ae748e228301f9fd0eed47a6b2c4c0ff546e0409617daabb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882054, "uuid": "dc7dee70-df41-459a-82db-2891b6228263", "comment": "Malware payload (AgentTesla)", "value": "cb7ee73c6d59fd51052647061098f56362e47fc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882054, "uuid": "2a147ffd-8bc4-4132-9a6b-85b0ed7ec1a8", "comment": "Malware payload (AgentTesla)", "value": "97eb6308a7353b268735ec103e114f07beb807e8fd0202d1e04ab7e31a862eb0a884c22ba30418b33ced9ccf6ecee35e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882054, "uuid": "90f6dd58-04fd-4310-9117-415eec1bedf2", "value": "T15215DF1A23D8DF42D5A643BD49B2EBD013B3A83691A4EDD85CC12CCE0425F52B957BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882054, "uuid": "0b850b8a-0786-46f6-a32b-0f8ee12ce501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882054, "uuid": "19111d09-acad-4c6d-ace9-496a67772641", "value": "12288:AcWlV/DfrpsiP4M/Qe0iICwehXRDXXLIp3mlYpxuITwr8pvA7c6MWlV/:4lpDTpTwMYeHX9XXiWlZGwroYrBlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882054, "uuid": "ff83f4aa-2fcb-4995-8e5c-1b7b9840ade0", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882054, "uuid": "ce09ba19-fd7b-4108-84fa-4465197b7d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882054, "uuid": "5a69de06-ffee-4cb1-8636-de809bb8b506", "value": "FedEx Receipt_2034174712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d32a054-a7a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675856446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856446, "uuid": "1f9cd621-b5b8-4509-b60a-7a75ef003f24", "comment": "Malware payload (Formbook)", "value": "41ab5bbead147ca7db73d398076e3fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856446, "uuid": "e8c8374f-819c-495b-a2bb-d739474517e9", "comment": "Malware payload (Formbook)", "value": "686802626b55d584dba9bb97f1a9c6b61cdb1f56ab9362cb57b333109ed3a486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856446, "uuid": "7a8ca9d4-5908-4531-b571-f2afece70969", "comment": "Malware payload (Formbook)", "value": "a0ebaff7957bf8799a03cca6ac70e8231d75eeec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856446, "uuid": "f4c08db4-f2a8-4514-a6e3-fe542bb4794c", "comment": "Malware payload (Formbook)", "value": "d91857631428c5c36dec2d4a720e395c37ca9f5c3121be4a678962fab5eb5fce4eead262c5c878aa1ea88c4eb383ce9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856446, "uuid": "e6b734cc-5aea-4c14-986e-a526df480b7f", "value": "T11815CF9C7650B6EFC857C932DAA82C64AB61747B930BD207A01712ED9E0E997DF104F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856446, "uuid": "24fa8f86-4c2a-424e-bfde-cadc8ba4fd6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856446, "uuid": "6d82519f-e0ef-4f27-8cc4-6d73eb4141b7", "value": "24576:l1BFwfrxN5IC54TWM/G9PXswdhfi+KOE9udmifzoaAneetX:lSjtgi55cw6+zOQmifze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856446, "uuid": "c2ad2bfe-0554-4590-97d5-1a23c152a6f9", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856446, "uuid": "4967766c-ec6a-43b6-94a6-2dfe1d53aca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856446, "uuid": "36d34e1e-397b-47c9-9eb2-6c6aec5de88b", "value": "REVISED PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2535d533-a779-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675837427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837427, "uuid": "cf83c7ba-7f0f-4235-84a8-49853d98cc51", "comment": "Malware payload", "value": "195dce2ed38d40c4720d56fbb45ba2a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837427, "uuid": "c03f8610-7200-498c-ac02-a4668b89f108", "comment": "Malware payload", "value": "687e2260dbec62311a50cf467d21c3ed5a9debdfc61336232e68c62937bb225e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837427, "uuid": "89f0fcd2-4526-4338-a95a-d0b4e0671490", "comment": "Malware payload", "value": "26e7223ddfbc116d327480233851a6bfdccf95c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837427, "uuid": "632d8782-f2aa-4c19-92cb-c1b3b9acd61c", "comment": "Malware payload", "value": "a4fc8feeb48b5186923892a57735b1d97b2d7dcbd0a44da02b9b6bd45608683983a84cccb88e795e02fcf92ae4ff4060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837427, "uuid": "bf9cd8dd-0869-45b4-bec5-f09f98853a38", "value": "T125763311B7D0C078E39A5472836A0B97D6C6F3650F2089273F9D43EE2679CA4C175ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837427, "uuid": "29c81755-fcda-4b92-bda9-e38f62e9ec8e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837427, "uuid": "9a5041f4-3c7e-4883-977c-1bcc6303cdd8", "value": "196608:91O90D+0/nGlXSLsk4NI34aHh5igCEBvfCp2jSEKt9Yk26KY4l7YXVqfBb:3O90x/GNSAlI34Yh5igCEJUnzCNY4Ko9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675837427, "uuid": "ceaa5aee-ac45-4d78-a213-a57b6bfe1ad9", "value": 7652467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675837427, "uuid": "8835e230-728b-47c4-9ab8-fd038c1c6db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837427, "uuid": "bd64227c-b3ef-4dd2-a2dc-73542d7b3005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e49bad7-a7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675858165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858165, "uuid": "a9a512b9-4408-4d8b-b919-010b76d69c7c", "comment": "Malware payload (QuasarRAT)", "value": "83cf6ce694b7f50b776928ad2a972689", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858165, "uuid": "041ac35f-53da-4a70-80d9-c342fe2f6fd0", "comment": "Malware payload (QuasarRAT)", "value": "68cd38a058c539806435416ab3458a618c4b4c7b1e9b7ec3e275569eaf874c4f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858165, "uuid": "36f9771e-2656-4fcf-86e4-f5a8b4f7cfa2", "comment": "Malware payload (QuasarRAT)", "value": "c2f13e4312e90e4be51ec3df1d5acba99cbb936d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858165, "uuid": "d30546a7-1c76-4933-9f0e-ad08352020d8", "comment": "Malware payload (QuasarRAT)", "value": "29ebd179800c461871860d0e919104abf35c9b108c79ac7cf7afe566e6fba9a87eafc30b43b9e2ab7148fac11ccd14d2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858165, "uuid": "9979d76e-dfc5-4abb-9218-0d41be92e130", "value": "T1C633E17CFB93113AC7A5DE354C0B796CB0400CDD5A2326CA60DE26D8AF9E7961BC0A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858165, "uuid": "f26d1fea-1532-4a15-b4c8-750da3d437c3", "value": "768:BFUNOL9+CYTIWE0rSJ3dgF4RgdEbyml03XmnoIh560HEuWp/wfuGmDzCh1CVoG:/xU7TIvSS3gFj0MNIhU0xt5mfyCGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858165, "uuid": "367be4a2-c09c-4339-85bb-0650f3519149", "value": 50134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858165, "uuid": "31f5b528-7985-4f1a-943e-94d10704fea1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858165, "uuid": "2958e617-dc69-4b15-9bd2-7264264423eb", "value": "Invoice_0942613.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61172b58-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675819918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819918, "uuid": "fde6de68-2c0d-4969-998c-a155e3594964", "comment": "Malware payload (Smoke Loader)", "value": "5a49d220b4ea8de3dc3f40333fcb38d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819918, "uuid": "b17cf4b2-c45f-4bbc-9ed8-c7129ac8b3a9", "comment": "Malware payload (Smoke Loader)", "value": "6900fa10edf6d796077ca032ed25e68cf09aee8eda35c5703b6d7ba727450cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819918, "uuid": "bece38e5-5ec1-4732-93f2-3b403c0831fd", "comment": "Malware payload (Smoke Loader)", "value": "f962adac084f54b4c2bb605b9d5d4ef8b7b22de5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819918, "uuid": "6e89340e-6d5e-46a0-b38e-6e136ef1ce63", "comment": "Malware payload (Smoke Loader)", "value": "a2d8626c90f2affa9184fdeca1a1e0e7f048338b88b433f7574459a16947d716778884aa8a9562c70860ab9e4367abdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819918, "uuid": "a629eb74-c026-4547-9bbd-466080da7492", "value": "T19E14D0323AD0C072C47627305C24EB656BBEB93051F5CE577BA81BAE5F202D2563A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819918, "uuid": "e12e8cf2-9144-4fde-9f99-7e8bfa54be59", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819918, "uuid": "4097ff4c-c5b5-40ca-bb17-7031c940f41c", "value": "3072:sGVO8YpS78F0nLlySnWya5f9D5Nvtr+aw/1K9uuqLBbLvtv9cEtozqV:sGVSE0eL1ny9DztKc9GbL3c+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819918, "uuid": "00c07932-a874-49d6-98b2-a926b8dfdfd3", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819918, "uuid": "c0f23880-9aab-47e1-9fb2-bea0ac28fd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819918, "uuid": "ae4d47de-5bab-46a6-b2c2-33ad710e96d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76dc00e-a809-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675899574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899574, "uuid": "080bdadb-39f9-4bea-a7bd-5d4b0957dd72", "comment": "Malware payload", "value": "1392e5afe2a0b7c587b2b32f078b2a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899574, "uuid": "ae9d286e-c551-40b6-8208-9f70ed933722", "comment": "Malware payload", "value": "69776e62e95e3482e76f323b91c7487f5de0fd8e3cc085354aaf3faf9333d36c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899574, "uuid": "2821319e-148b-4ea5-b289-e1e1380f6d08", "comment": "Malware payload", "value": "079407ac4c3cac3703ccd21635d85f25588821dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675899574, "uuid": "08b19ffe-ea4d-4802-a360-16fc318b754e", "comment": "Malware payload", "value": "2ac5670dbb18e956c77a2cb0071d05f7afedf1f34b96f44695d671091c6937f69cb5cb679d634b3920bb9ebf7b05015a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899574, "uuid": "c8c00209-b2e9-4eaa-b27d-c23bc7782bf5", "value": "T148C40147E6EC9072F8B957B018F606C319357DA06A388397374EAC5B2C736B4A13176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899574, "uuid": "76d9c611-8b27-4af5-84c0-f22a464a873e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899574, "uuid": "f6249b89-f662-47cf-8265-199611bbbe5b", "value": "12288:yMrVy90HSSYqgrlu0uXSFcWoOyTLF5MoB+:HyqYqgRSyX45MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675899574, "uuid": "3cfcb322-c790-457c-8561-da7ba21502b6", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675899574, "uuid": "99e421d1-9997-4a67-8135-b23d92ccb8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675899574, "uuid": "2efed07b-9a65-4895-a035-31de9cf3a19a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1283077-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883296, "uuid": "0b401868-e7c5-4653-9d25-872927789820", "comment": "Malware payload", "value": "750f66f95e266a95b7e514b5f3f5b08f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883296, "uuid": "58a1c48f-d457-4331-aa2a-3e212d015388", "comment": "Malware payload", "value": "697e8d0d76f9fd7428a2033cb8608f7d63578db1fb71a1d7440ed4b7751b3a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883296, "uuid": "6812f46a-b0e9-49fc-a2e6-ff684d4535bd", "comment": "Malware payload", "value": "e75f2d0d54f784b1f953c93e40a924bb31a6bf36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883296, "uuid": "09cdfc7c-a0af-4cef-8665-0eed3a289458", "comment": "Malware payload", "value": "1d398698499ab2e1ccffc52b133d6176c3efc9cee1e6e4acb8ce9276492fd2c1b9a4aa4e63f43d53c7a83a4018e3d0f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883296, "uuid": "45eacdc8-05b3-407e-9cf3-525675723f0c", "value": "T185438D31BAE1C473C553A570506597A1AEBD6A2123B6C8CB0B681EB55F303C2937F36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883296, "uuid": "48d6a4cb-b246-430e-a3d0-fecddafb49f8", "value": "768:eFDh1PgXGb+2KhKPbannWyknOhRDEYG32isDgAwAF3OJnbcs78l:UPgX72KgyGCNEQgjl9l7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883296, "uuid": "735c8f69-f314-4e4b-9f69-845e9ba1d556", "value": 55272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883296, "uuid": "67e33eba-0e28-4eaa-90c1-414e9ce90ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883296, "uuid": "47504b7d-a80f-49a4-a5e5-76010722789b", "value": "750f66f95e266a95b7e514b5f3f5b08f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc30006-a7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855450, "uuid": "c849c249-7219-43c1-bd30-ff13ed94e6e3", "comment": "Malware payload (AgentTesla)", "value": "af3afdb900624af15bd0984c7c6e236f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855450, "uuid": "a4f5237d-5afe-4880-84cc-63d25abeccd2", "comment": "Malware payload (AgentTesla)", "value": "69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855450, "uuid": "ddac6317-592c-4792-944f-19018175e170", "comment": "Malware payload (AgentTesla)", "value": "ecec1c4b32f1c4b7c36a9e1288ca6fc2e0c37e65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855450, "uuid": "7df141f0-041b-4e97-8c10-f2de3c4fb791", "comment": "Malware payload (AgentTesla)", "value": "31293481cc7a193e573752f6d3e557cdce0145ddcc09c395399d3617d13f58e43532e02e7cdc867570c410be3417810a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855450, "uuid": "67dc6a7d-c859-4a82-aebe-11abca2592d4", "value": "T110842301A774E266C4F257B28E2B1BF21E6219197C90C26F0708996F3C76BC1E71D7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855450, "uuid": "90f00674-23f1-44fe-8ce6-8fa5f53d6ba2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855450, "uuid": "f23ff3c9-b48f-4d02-a7eb-67729b60c49e", "value": "6144:/Ya6q0fMteJiHLKzBBF+JmsGhO5nuJLudiBte7SSjxzBJd2KowUylh3eo0sgVAct:/YMztbH+BBFsms8I+rngJUyP0sgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855450, "uuid": "0a71d3ed-c83b-495c-a87a-516ccffd4115", "value": 406340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855450, "uuid": "4174b1db-8bb7-4048-a71d-7f013da7813c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855450, "uuid": "21da1371-7b6b-41eb-a797-8e593efb9c4c", "value": "Urgent Price request P.O 1672891FTN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e747a944-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883279, "uuid": "d294115b-7245-48a4-bff8-d22be5f00819", "comment": "Malware payload", "value": "f1c2717d810d6f5ab1272124ee529001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883279, "uuid": "01d563bc-1bd4-4f00-8998-bd02425fdd41", "comment": "Malware payload", "value": "6a7e7099c98caacce2b7cb3e43f6bb88bb57e589f4c8541ae911067d4313680c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883279, "uuid": "130c1717-afda-4928-9e9e-8aa32f385192", "comment": "Malware payload", "value": "c21904890ae6b5a6a1a8f85240d0d93277a128db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883279, "uuid": "ffe9d03e-a6e6-4c82-a661-31307850940c", "comment": "Malware payload", "value": "2990a7cc6447d881c03ef698aa6f62d5ad08cfd305ef1f2658bc95d4d0f8290e008ff11681a160de7dd3a1a440088624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883279, "uuid": "7569c459-cbe1-4733-a1cf-a96b98079878", "value": "T188951203D2E27C85EA568B769E1FE7E8725DFA208D09B7653218EE2B14F0362C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883279, "uuid": "145b6e0d-a84b-4875-a8b0-107f31a3498c", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883279, "uuid": "9e55751e-3cf4-47fc-aeee-6bc98afb949c", "value": "49152:YU3A8z0La9dXyM1GGvCNxWG+rNudXk5HjLtU2TezV5M42S:lA8zlXj11WYVueHj62sF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883279, "uuid": "c04afcdf-ebc6-4271-b35e-6ff7d9c59736", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883279, "uuid": "628565b7-b0c9-4508-ae9e-f2045690e57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883279, "uuid": "37b6166c-e344-4c75-bd95-af5ad70435f8", "value": "f1c2717d810d6f5ab1272124ee529001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ac3b32-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883163, "uuid": "43431dab-884f-4b2b-8f9e-7c35ee98cc7c", "comment": "Malware payload", "value": "3117af99ba7af6a0527d3c732d24a8a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883163, "uuid": "b03d3960-8d2c-4680-9954-ad90f71d9c22", "comment": "Malware payload", "value": "6a9454052a6803b507c1268e65c270a0b546fa098d240204933e9c4028e05bc7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883163, "uuid": "efc99595-23e6-47a8-bb51-fa8b1ac01232", "comment": "Malware payload", "value": "4d9988d35188279b19f39b8b55753279fada1f25", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883163, "uuid": "648f57cb-d69b-4dbb-a3eb-2de12408aa5f", "comment": "Malware payload", "value": "1674af1ef609ca9855c8f829dfa664330f3160f4837dad70b56857070037294b4bcc0424e8b54f29abe99c4a037febd8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883163, "uuid": "7dab095a-f43b-45f2-8939-2f4f8f3c8afe", "value": "T1AD35F107E57AED2BEC16C57CEC4F649282129C79B808CA4D21C3BA1F96367B11D3ED64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883163, "uuid": "daa065f1-2299-4fda-8afa-0b2227f1e1d3", "value": "24576:NFeXPuwtLNFeraEezjGmvvDNDaDtc2b2hV39:/IWwx/0O/vRD9J39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883163, "uuid": "f5703f69-0b4c-44e0-a1ae-199c57bfa6b5", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883163, "uuid": "497db725-d68c-4ef1-a906-db045ac5b309", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883163, "uuid": "1c7adcd6-231b-426f-8cbb-661238778e40", "value": "Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70feadf-a7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883708, "uuid": "7afe19c5-08c3-432c-8f6f-49f60c9bb736", "comment": "Malware payload", "value": "573ee9291fd1dcbc40802b2f13a00993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883708, "uuid": "b792eb17-e1b9-4707-a605-a34b48c92456", "comment": "Malware payload", "value": "6b18d49fcc1a769784f4159bc3cb06812f235732bc285c1a79bedc4b1836df98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883708, "uuid": "00760626-7caf-43d5-a7c5-5d202bb5acf5", "comment": "Malware payload", "value": "451c05d077b85f22a201cb633a0df7f9220d7673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883708, "uuid": "dfc007da-2401-437f-b111-fe42e7e9806a", "comment": "Malware payload", "value": "5d7a72a1f7cfaa5fb35f3b6fc4f8c2aa0d97eef4ceab7b37b9653e39fb1c1612a4bc3db39f3beaf69b77da94e71c2165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883708, "uuid": "0e5afd7d-7772-4b6e-a26a-8b2c40309d59", "value": "T18B642903D2E17C84F9268B769E1FFBE8765DF5608E4ABB693218DE2B14F0172C167610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883708, "uuid": "91bc57a4-ca22-4a17-b28f-6c4360ebdbe7", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883708, "uuid": "889bf986-5c30-4be5-952d-34ed2f956dd4", "value": "3072:nPg9RI1dxR9rsI+FW5ywNfMCQHWNi6eKOvI7Igbjl/sWQDiuLpZph1gv:n6ort+FW5VfzFY6eKOvQNjlkLiqZzuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883708, "uuid": "385795d3-5c58-45fc-a59d-b35623e36b0e", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883708, "uuid": "731c4543-c748-474a-a573-4a7c3d2b7064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883708, "uuid": "0f815fc7-0e34-4f7b-a543-1663813a967f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69105a31-a7d3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675876196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876196, "uuid": "78907544-ff42-4c43-be1d-f2a9f7cc747c", "comment": "Malware payload", "value": "a669387d137edfa9f2fccc10b3a72b85", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876196, "uuid": "2b5dd430-d382-470f-8e56-f4db219e037b", "comment": "Malware payload", "value": "6b433b25a07898af68fd11fba29e3aeb5a4e33b353b624b98bf982e9707a43ed", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876196, "uuid": "e2c2496c-850f-4845-8bfb-ac84d618b406", "comment": "Malware payload", "value": "3dda756706204bf24c331b11255a1df097322809", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876196, "uuid": "d1431688-1e93-46ae-8bf6-938b0a52ef92", "comment": "Malware payload", "value": "687a6396a887feebd72b6eb23c9d23e6625db4665ca62566931c9b0ad1c200990c1162c8b3790f6f544a7af8e66af056", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876196, "uuid": "43670ef7-150e-4092-a85a-bee5f2bc582e", "value": "T13E11DDB66B2E5012C6F5CB421D47925ECF7041A158C00710B4FE4E75EE3A213A35EACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876196, "uuid": "de4752c1-4288-4642-8d0a-8c0bcfd3867e", "value": "24:DOVtyCiP9sFTxnswvpdPNuR71q2z8JAh/:DOVtyCiP9sFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876196, "uuid": "d2920bd4-ed21-4d24-b5f5-873088c35cd8", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876196, "uuid": "0821d178-3d36-4391-a2eb-b8bc3990569b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876196, "uuid": "0e2fb0e8-d106-4bbd-8642-9838bf8eae31", "value": "w8W4WtPL.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4a0455-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675881197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881197, "uuid": "9c9ad8dd-e501-492c-8a69-1211d3e5fe7b", "comment": "Malware payload (RedLineStealer)", "value": "901509c01c566c8b9608ff75e7af975d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881197, "uuid": "806c6802-220c-4ff3-9fa5-cdf327934324", "comment": "Malware payload (RedLineStealer)", "value": "6b5939fb25c926493a82c0eea8b9da908c9c129ad486394a85b637d91de566fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881197, "uuid": "21502117-e7b7-450e-bc2b-3aebbbe33831", "comment": "Malware payload (RedLineStealer)", "value": "02840e9ff8d4d2d6256bb431072ddb18919f52b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881197, "uuid": "1ab16c32-1075-456a-81cb-373b212cee08", "comment": "Malware payload (RedLineStealer)", "value": "12ff5e0c9c1a866962244da7289aebe4bce852691b03b5aa327f2ca56e6b551cfca28d75890c9ba118897a46376c7cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881197, "uuid": "19b4f426-9fcd-4388-b8f8-36b71152a0cc", "value": "T134946C03D2E17C80F9658B769E1FFBE8765DF5608E4AF7693218DA2B14B017AC263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881197, "uuid": "e754ab25-4f57-447e-a6f5-35ee4ce712dd", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881197, "uuid": "cc439dfe-0cd0-4041-8d7b-a71057f187fc", "value": "6144:42LralNDU5KuFwUE4on1HJlfpMcPm6NIFgLiq7iv:4qAN+3181JFCCm6SE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881197, "uuid": "5ce64f32-ad01-40a9-b3cb-6512e30d1b2f", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881197, "uuid": "d2c66870-6987-4337-8dd5-ac65549505b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881197, "uuid": "06d916dc-b3d6-4c2c-8de0-482c08d4afbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119d130f-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675882062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882062, "uuid": "0065d15d-2ed4-4fe2-96c2-77660c3fbc53", "comment": "Malware payload", "value": "a41a231a94d979fd71078e622f0eb2ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882062, "uuid": "7de14125-a3ab-4a68-a391-3eec89baf100", "comment": "Malware payload", "value": "6b84f4d2268130195a2f388ef3831dab3d75c4999e4f6d45d8ede4b1af8bfbef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882062, "uuid": "eda7dd89-8f3c-47ab-b2c8-dde0298453cc", "comment": "Malware payload", "value": "7178711888c24d297811882093b35522b0cc4874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882062, "uuid": "fb7f6e05-d503-4834-b330-4752886457ba", "comment": "Malware payload", "value": "5fbb1cbf1d7f01e8e56b00a7d2906e503067b943aa4482395e1cf6c26d84dd1c810c28645f0799d74cbd404d6a1fbbab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882062, "uuid": "8869c0d3-eeb6-4912-9c4b-fa52350694f0", "value": "T1163623661371004AD2F6CD3EC1737ED932F6133B4B82A878B9DB99C139975E9E602943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882062, "uuid": "36ca18aa-e925-453f-a0a0-b5699b3c6333", "value": "5e9605053241048804a45d140ab81ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882062, "uuid": "b815e563-1db2-46cb-8b7e-238f34e2d576", "value": "98304:yPAaRcGnYmexrS0M60BMA4Df8witbDNqLfLNVgY+7HlqiiwFr:UxYmexrnm4IEnCF5iwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882062, "uuid": "dc24c6e9-5284-4f60-8334-f2ac2a342b3b", "value": 5100938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882062, "uuid": "bff6f695-6474-4792-9393-362cc190cf9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882062, "uuid": "e3a1650f-45a2-4a5d-92ad-16039d0cb727", "value": "a41a231a94d979fd71078e622f0eb2ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa9e94-a7c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675870269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870269, "uuid": "24106e7f-3524-4b23-9572-e3a1d76e7312", "comment": "Malware payload (Formbook)", "value": "dac5ac774069414c354240cb0a83727a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870269, "uuid": "73104aaf-f81e-4feb-a7e7-5d3d0fcb05f2", "comment": "Malware payload (Formbook)", "value": "6bc87d562d2667c71015dde859770f7ef5f0e10bc8b4c0291433ff806b4023aa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870269, "uuid": "d0e676fe-c868-4ea4-8d99-3ad30b1d7d71", "comment": "Malware payload (Formbook)", "value": "f944c7c6f17827ca975314de4929bd51bacb68c1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870269, "uuid": "3ec993d3-7738-4cc6-aebc-e7d0a7764195", "comment": "Malware payload (Formbook)", "value": "9fc1b8c403d8c8ea2504f145cebba1402b657c5d1dd8672550a1b8266fd0ccb18b173d5a51242bce06e456af046d974e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870269, "uuid": "950b7f37-f5c3-411a-8a0a-afcc4f66911d", "value": "T132D4E00FA231DE6BC402C77C9FAF4B91165BBE389613655F2500776E1F322A599FE208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870269, "uuid": "5dc8ff04-9479-48a7-b7d3-f6bce53fa295", "value": "12288:QaFiKXKRVmzBZBAhAYyCFsgZuF3WB1iaf8wshOkp:lLKjmBghtFsIOWBJEw8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870269, "uuid": "8c4a31e0-914d-4018-bc81-4a2f7857004e", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870269, "uuid": "fcdc34db-a239-4932-8c0b-bd2dd267061d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870269, "uuid": "b2af3d61-34d1-41c2-b57e-872767cb2048", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f5d578-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893395, "uuid": "b8d8d99f-25be-4f46-82da-ce4a1c328ff3", "comment": "Malware payload", "value": "dfc48585184f1ac99bc980ddbaa877ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893395, "uuid": "6cc9f1a8-c0c9-410f-a904-75b42b431618", "comment": "Malware payload", "value": "6c5ed0736daa0c58bd42543c09b2420eefc784cf74e16f34775f399833fcd4c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893395, "uuid": "b527d623-d9da-413d-b029-e71107487f3e", "comment": "Malware payload", "value": "60bd05e314008a2f21dfe11633effae74e18c293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893395, "uuid": "24e350d0-f4d2-4311-9f48-f72f2dad6e9f", "comment": "Malware payload", "value": "ba77809bd4d17875546868610c2a71d671c1a2be4d3c0ecc848f74926a3484762b91740f5daeb3ed16af567a1f09ead7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893395, "uuid": "d41d6309-f815-4fc7-be2e-afd7ec385df1", "value": "T1D276337B34D18D7AEE6170B3C6150EC1D2B3CB042B35C1A753819DAA6D79A2AE737E01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893395, "uuid": "f50f5180-8ec1-48e7-b53f-9bc302b4a83c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893395, "uuid": "89c8184b-7f38-447f-a5c6-bc5b43708b1f", "value": "196608:91OZlSctWsaahwnZFEW/O6+1QpFxE6vMzYpeUl:3OqY22wnZFEyO66QpPX+Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893395, "uuid": "d3f8eaad-6402-4f58-8448-4ec4f5f624a1", "value": 7653619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893395, "uuid": "c7b20871-c97f-46f3-bfcd-3c8c6cb19e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893395, "uuid": "961db4cd-2962-43fa-91d9-7f31bbbc5960", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e179023-a78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675845146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845146, "uuid": "ae65d81f-5f35-427e-bf24-3527c7a7839b", "comment": "Malware payload (AgentTesla)", "value": "4084c52c95be76e74f546f59bcc193f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845146, "uuid": "1b5a3423-cb09-4677-87cc-f2eb78edc9ea", "comment": "Malware payload (AgentTesla)", "value": "6c74454498d40cb44c42400f6fe05e2359289ba0b75c3431fb530e9620e685e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845146, "uuid": "c8bab3f3-0e6c-46a1-a72b-4be843a5acd1", "comment": "Malware payload (AgentTesla)", "value": "d2b2ae663d8d2c7ce5d417407f48a4d6ae533d1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845146, "uuid": "5a7b4166-ac51-4db9-9a85-985678c1c054", "comment": "Malware payload (AgentTesla)", "value": "90ff29c29881ad9fda3ca0f01ec9b928db4861fda590f31f4fcb5117b4c0fb75a37b1d95c245eb0dbc1a2fc159b1d290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845146, "uuid": "428bfbd3-d8c4-4036-81ea-2b01c5a551ad", "value": "T1A3A2D1F2D1431D95BD36797B245D6231683A2DD036E5DC03E76BAEA7C52F109563C808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845146, "uuid": "e8d734ca-c612-4c75-a347-f8a8c7f2a890", "value": "384:UUu6B/tj7gkwIUh+PKuaxhl9KzSPr7STPImwchLcrnCGvk4HfXoMShtWSjntEK:UUXBF3pQhl9J/aXpcrCyk4voMSTWa6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845146, "uuid": "d4c3ef18-9852-4dc5-89b7-824643e05a38", "value": 21636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845146, "uuid": "402bb005-b060-473e-8209-5d01c455b4bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845146, "uuid": "d187b735-ad55-42a3-8c51-9351f9d44bd2", "value": "S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2430124-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675882358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882358, "uuid": "a6793d17-ac7c-46c9-a44a-5e7594447000", "comment": "Malware payload (PureCrypter)", "value": "1f9497e759ce77d4aef629ce1235037e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882358, "uuid": "6b545397-ae64-4ef1-9cf4-21164f5d2b02", "comment": "Malware payload (PureCrypter)", "value": "6c8a572658c9ac6a45856221e0181cedad7e322de8c1b90e93b801bdeb1cf878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882358, "uuid": "eafcbb58-d562-40cf-aa33-e2225c0f52d7", "comment": "Malware payload (PureCrypter)", "value": "3ebacd12ff11758ae5767f6e284e42b9e83e0067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882358, "uuid": "c1a76a34-68d0-4a40-a391-e977ac15da3d", "comment": "Malware payload (PureCrypter)", "value": "c1607dc05f0a4fa6ae69ee6e63786a29e399c3a5a3edf30ebc38a99b98ff3afd1e009ca76349f82208205d47ad864325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882358, "uuid": "cf364acb-0473-4bbf-926d-e99deb490571", "value": "T163E5CF25229C91C9D17AD03DC9864AABE7B57C428364D7CB05A0BDA93F336F56E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882358, "uuid": "12dfcb5c-9eef-49d2-a077-05e59c5f627c", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882358, "uuid": "95bb8165-dc35-4942-830b-c55eb9181698", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSFzdY8la/VdPiE7pud:Vv08Ro21Buk5/xgX1s2eXF4lzFUJD+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882358, "uuid": "e61e1750-7f8f-4415-9cb4-16a043901e23", "value": 3204682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882358, "uuid": "30f22714-69df-4624-94d8-9ea6510b62b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882358, "uuid": "88ad41e4-650b-4dd4-8689-427d217ca4ac", "value": "1f9497e759ce77d4aef629ce1235037e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50847354-a7c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675871430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871430, "uuid": "4e633219-3a32-4872-aabe-4ad2bd7cc575", "comment": "Malware payload (SnakeKeylogger)", "value": "29dbde556f2a1620b041059148b7af94", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871430, "uuid": "d984dbc0-d7a0-4033-83a1-b790e0daf510", "comment": "Malware payload (SnakeKeylogger)", "value": "6c8f43965962f12cf2d1607f5b59ea9dabadd58fd91ee13825fde6e9f11f6a32", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871430, "uuid": "c78a7a2d-5a55-4b7f-84be-6fe7a6ab34be", "comment": "Malware payload (SnakeKeylogger)", "value": "8b7b4fedd88c3380bdd2d939091f8ea507100202", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871430, "uuid": "ba79021d-6fdb-40b5-a4c7-f7f896a601de", "comment": "Malware payload (SnakeKeylogger)", "value": "71afa85aa52e90f124b269181bfdd101c4207f4d6fa2a2fdd175c1a0a35555d74330057eea6aa159f2607f629f841d00", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871430, "uuid": "7cc5d3e6-e3b8-402e-9e14-7c74fecbd619", "value": "T1DD03185AE79F02A4CF511273531B0A899ABDB33EB35055B1346C933433EDC2E42669BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871430, "uuid": "8c36f7c4-460b-46b0-a948-33fd9be650d5", "value": "768:nFx0XaIsnPRIa4fwJMUG4BBNhuzx0GYaaKEOhPm19f7awSo9mEAT5a2xj06PSyyh:nf0Xvx3EMXWkz6GYDZOh474WmHTI2x/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871430, "uuid": "f83c13c6-f0dc-422f-9452-6607ac3eca42", "value": 40271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871430, "uuid": "fa30bde2-7114-4b1f-a7e4-5631ec7cf690", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871430, "uuid": "c1f4d76c-bd19-4e79-91f2-f5215f95f4e8", "value": "ITEMS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218378e8-a79d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phorpiex)", "timestamp": 1675852883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852883, "uuid": "4c4c3a93-05df-41e1-9796-547113282989", "comment": "Malware payload (Phorpiex)", "value": "7d61d9862142353bce359f182437f5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852883, "uuid": "fb1d636f-147a-45dd-a654-2722d46f0bff", "comment": "Malware payload (Phorpiex)", "value": "6cbe8a25f7a27d7e68e90923468abdd804d7c0e29cf9979544ba43edae400955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852883, "uuid": "cc4eeba4-6510-440f-838d-2af8e835a4b0", "comment": "Malware payload (Phorpiex)", "value": "7acf12fc4064ed246987a8014546367cb3ae04ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852883, "uuid": "a9438405-daec-4871-9c4a-63aed54ac3a1", "comment": "Malware payload (Phorpiex)", "value": "bf5064e1643a32d5df942ed7a1004817a794d8dc4a96f4b095ec9c48d76758ed4c85a94fe2196ca24c0066e92bd3d5bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852883, "uuid": "c7287605-140f-4dbc-a847-f50057ce72b4", "value": "T176C47E32A6A04037D6F106B3FD24D6307D7DA2187B1184ABD394AE1D2EB8597A7F7213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852883, "uuid": "d7f41f63-7f29-451d-b83a-7f70772d7a05", "value": "8e2588a9cf43886de3449dfff03137b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852883, "uuid": "d114f08f-0ffd-448a-a4e6-1cf46b14987a", "value": "12288:WAqkoCtQO4Nai3jk/PElKgyObjdGCzLSFf:WxkoIgNaP+KLOHdGCze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852883, "uuid": "c3c9bb0a-0a83-4326-8199-f093fb6912da", "value": 547768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852883, "uuid": "f4282f7b-774b-484b-8a80-a7375adc1835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852883, "uuid": "282313b0-bfcf-4abc-a0f3-cfed70c6d2c8", "value": "6cbe8a25f7a27d7e68e90923468abdd804d7c0e29cf9979544ba43edae400955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedcce79-a7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (LimeRAT)", "timestamp": 1675875051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875051, "uuid": "7062e116-38c8-43ed-81aa-a80b3706409b", "comment": "Malware payload (LimeRAT)", "value": "d36f15bef276fd447e91af6ee9e38b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875051, "uuid": "c7581282-3a44-4491-8d09-d714bc1f4584", "comment": "Malware payload (LimeRAT)", "value": "6d08ed6acac230f41d9d6fe2a26245eeaf08c84bc7a66fddc764d82d6786d334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875051, "uuid": "aed3ef01-635a-4c2a-9327-251b9e70f717", "comment": "Malware payload (LimeRAT)", "value": "14836dd608efb4a0c552a4f370e5aafb340e2a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875051, "uuid": "1bb97780-3511-41e3-93a5-711c8162fc50", "comment": "Malware payload (LimeRAT)", "value": "8d85680d4f72fdcc1088f8e92e1c3507cd2cde8b60924d280b45843b2aeb4888764027f4d4bd7ce947ce9eae58ed5cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875051, "uuid": "f75712c4-76ea-4b08-a766-b286f358f22c", "value": "T11524B6C032D55E9AFD8C2A39A300E2B5163D1DFBFEFEC16949E29C93355B7900A459E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875051, "uuid": "8f7127b4-c6ba-4178-825b-663683305279", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875051, "uuid": "46b7201d-87ee-4806-982b-f3be8e64391f", "value": "3072:DDiv2GSyn88sH888wQ2wmVgMk/211h36vEcIyNTY4WZd/w1UwIwEoTqPMinXHx+i:XOayy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875051, "uuid": "d8255845-5d3c-49c4-983f-794a64320ac7", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875051, "uuid": "4b2ef695-60cd-43a5-9ba4-f1716e0cee1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875051, "uuid": "7588ab07-5cd6-4e84-8307-cab2a6f1fd3e", "value": "Checkeur netflix validator by crips.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33f2089-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893554, "uuid": "080b4ba4-5861-4b62-b7a9-80b1ba1fb6ca", "comment": "Malware payload", "value": "20906b74c322a6c1f760563a89f74a9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893554, "uuid": "c8117278-15d2-4680-b9cf-81394bd27309", "comment": "Malware payload", "value": "6d0fa8c2575feebbb9ecb57832b86256844d7d336e6e118b32b3c5d466bb780f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893554, "uuid": "8c912b64-c48b-4328-80ad-b6cb2705d8c9", "comment": "Malware payload", "value": "5850cec74dc77132772857ead656bf28186a4a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893554, "uuid": "eac1e24a-caf4-4e22-8b41-536aa245b6f3", "comment": "Malware payload", "value": "1a95997786ea080f7600ea5f186018e669c7a36fc8c80d22c03b14806afc8ccd43580791fa74ec42731b75a3902df4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893554, "uuid": "6ace75bb-9144-40e4-a747-2bf1bc57cef8", "value": "T1C3641903D6E27C81F966CB769E1FFBE8B64DF5608E4AB7653218DE1B14B0072C267610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893554, "uuid": "ecdcbefd-8348-458a-a335-8094fcf92e70", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893554, "uuid": "3eecd2a2-4717-4b95-be87-73f59d8b1ddd", "value": "3072:bPgbuJ7n5RFgQgs2lOZSv9jzlVizX0xSA650wPWKGsWQDiuLp4IEgvG:bUgdgQuDZbEo657NLiq4IJvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893554, "uuid": "ee99f7f3-4ea5-4c1b-918c-f54f04367ab2", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893554, "uuid": "ecae706f-3cb3-4d26-a5dc-d472526eac3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893554, "uuid": "7fd572a1-9f32-4a9c-b42c-45be23165004", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e155f9a4-a7d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675876827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876827, "uuid": "ca422535-a734-4bfe-86cb-7520427f5af2", "comment": "Malware payload (RemcosRAT)", "value": "1050764a01e932338b57656f989e3511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876827, "uuid": "b61d15ac-486b-4a57-a9c6-8858cc94a742", "comment": "Malware payload (RemcosRAT)", "value": "6d810e2cbf50de17bcbb876ede3d23767f6454d7cf8dd9f4ebadeb56b342cea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876827, "uuid": "abb8f2a3-c842-4e26-84c3-b38a73c541c9", "comment": "Malware payload (RemcosRAT)", "value": "c10fd6e41ed03a02e5727c655c832a9722460a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876827, "uuid": "14621891-ab60-4d4a-840a-93021f41c812", "comment": "Malware payload (RemcosRAT)", "value": "1030d8c3a85e4534eade5b33d0fb4857c82685ae4c08504ed4e9ab517906dfbf6d20a0e18af2f3075c80154271610467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876827, "uuid": "0e054770-fdbc-4797-9564-d0d61b21765c", "value": "T1256540B058BB85E9E00FC9A016FCFCA401B67DF3DCC60D65836CB6840E7AEA46E5550E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876827, "uuid": "008d4d87-b6c9-4d5e-b31f-bf8ae9917fc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876827, "uuid": "bbf07914-2886-40de-a7fa-48f2e6009ce2", "value": "12288:1qSXsXWOIE3KAUNfIkCsBNoKRoAWsPuK1wTaxOVeTGxemZQYl3KWns4Yaz:VtwTZQCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876827, "uuid": "34800b95-c989-4cb4-b6ec-3ef3ae23092f", "value": 1448960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876827, "uuid": "d2aa3ae8-a31b-4b76-b251-8d41d9d712f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876827, "uuid": "40799c4d-3865-449b-a206-7f6b4e48941f", "value": "Jgofatpaj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dab7544-a79e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675853386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853386, "uuid": "8006a807-472f-4105-a1c4-e29f2faf7e74", "comment": "Malware payload (AgentTesla)", "value": "f50b2332c2d7447c627d51c4f9194d6f", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853386, "uuid": "31de7f69-9903-4e81-b475-2f214a16465e", "comment": "Malware payload (AgentTesla)", "value": "6d8d80ff0da154de883e68655be346b69b79072f7a0a0c785b7c3faa23719803", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853386, "uuid": "e8c797ce-ca95-4e32-91bb-4d7c298f8abc", "comment": "Malware payload (AgentTesla)", "value": "f52b7df3133c43b0ba7149f71e880acbfc6900c9", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853386, "uuid": "a896c1e2-9623-4ebc-8549-3946524f4415", "comment": "Malware payload (AgentTesla)", "value": "b3e6c261f44e9309bcdeaa33e80247d71926dffa7ed0884eb459f5feafcc965fa4c959e00505fe8f53bf218473b81326", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853386, "uuid": "b8935615-18a3-4cba-b978-17483095bc62", "value": "T1FD94230A167DC2A6CBD141B1086387DCF8759A8F01F246D5FA4EF473A43027AD8AF799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853386, "uuid": "5ccf47d0-8cea-4d99-bb1a-fde2f27ba3a3", "value": "12288:W9HM0NnDLyNmDp6XzAFbZE46G5p9OwRINGYO7ipPae:WCADLyN86yFE46GX+1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853386, "uuid": "86805190-8fef-4b87-affb-a34f664d6ccc", "value": 422451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853386, "uuid": "41146c10-63f9-44a4-923e-1e946ebc4879", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853386, "uuid": "4bf83905-213e-40d0-9b31-7b05b398b8dc", "value": "Dewell HBL DRAFT -HBL#SBKKS0007377-MBL#COSU8029379970 -6 FAB 2023.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaea3ee-a78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675845065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845065, "uuid": "51f030b6-cf79-4a48-a640-4479b1d622e9", "comment": "Malware payload (AgentTesla)", "value": "b15665a42716d5ed43378d1e59ea14af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845065, "uuid": "ba8d42e0-cc56-403a-8b1c-68eca5193da3", "comment": "Malware payload (AgentTesla)", "value": "6dd9e51bfcfa8c8c675b80bdbd1718f524f9024ca578d5e7503664d4dc63b0d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845065, "uuid": "8cb1755e-7132-43ff-9f76-d733690847a7", "comment": "Malware payload (AgentTesla)", "value": "ed1d0d697998021a22e1cc7d3c62cd1af0016581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845065, "uuid": "add21e71-f372-4b29-a964-11ef1add162e", "comment": "Malware payload (AgentTesla)", "value": "1f711bd0f5b48a6ef1fc182f70bdef101498e397b5b55a6bb3a87bf7e8d0f9b7788249bcc5feaa93982fb466d0c64540", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845065, "uuid": "bfc16cb6-a506-48e8-97a6-9a11ba55361e", "value": "T1B592E12A1103115920DCFC3D5B5E5F63BF5ACF98464E1102BEE95CEB9C9184C3DCEA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845065, "uuid": "9a63c51c-b76d-4b95-aef6-9b435dc64c06", "value": "384:wy6+54AgKW4k4fU1TDO2M5IaHtU7f2HQw9s0z1OJEVefBjveF:wy6+1gKWF4sRDxM5Zu2HcrwomF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845065, "uuid": "96711169-6efc-4f9f-8926-60a52b4eaf37", "value": 20770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845065, "uuid": "ffc87265-38e4-457d-a769-98852b5c82bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845065, "uuid": "68f8640e-058d-429e-b013-80f3f34de56b", "value": "SOA.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c16a1ac-a754-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675821628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821628, "uuid": "dbeca6d5-b156-423e-bc5e-5a9c7513e4f3", "comment": "Malware payload (RedLineStealer)", "value": "35142d565261faf51e5a1ea26104a4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821628, "uuid": "87129703-e4bd-445c-b97f-39fe35f01539", "comment": "Malware payload (RedLineStealer)", "value": "6e333edb882299ec9a1920f83ab134bd7f017449889af36118eaf72e2c1b9fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821628, "uuid": "84d2f8ae-e976-4d44-a7e4-1bbd0b1f8b3b", "comment": "Malware payload (RedLineStealer)", "value": "5c7725104dc62d758b842cccaec115b6b7aec440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821628, "uuid": "866c6a5d-64f1-49d6-9318-c53173ba9c98", "comment": "Malware payload (RedLineStealer)", "value": "0531211e451b5dcb21e1131a92e0dd85466dc9cfa64f4a6102efb5ecff9fe1400cf0ee1acf8e82bb7230b02dd06b7788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821628, "uuid": "21d1c478-b27b-4b69-96d3-273a48dd4ac2", "value": "T17464F12237C0C473C46365742971FBA96BFDF930517A9A677BA403AA9F302C19637362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821628, "uuid": "a2bc5417-981a-4b4c-96fd-8678a43bac62", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821628, "uuid": "bc30c532-80ad-47c4-83fc-8dbf0917b55c", "value": "6144:dGlnbyLFzdKXh3fyqqXv5MvgTFbhWyBo7XquuWzlCec8wPv:dGlnbypz8Xh3f8X2vgTRO73fpCecF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675821628, "uuid": "22fd1d34-ceb7-48b9-ba53-c00611cded81", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675821628, "uuid": "9604d2d1-28d0-481f-98e1-7a84373583d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821628, "uuid": "188d5c2c-f327-46a1-a205-51f6e9ae20eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eec2fc8-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881359, "uuid": "122abba3-384d-4658-b2d6-aad7b83c2382", "comment": "Malware payload", "value": "dfa81020430c1ef567f78d42cee9fc7b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881359, "uuid": "4b7a0f35-b108-4877-93cb-1e5b3b657d2b", "comment": "Malware payload", "value": "6e494eb76d75ee02b28e370ab667bcbcdc6f5143ad522090f4b8244eb472d447", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881359, "uuid": "ac2ba47e-27be-4bdb-8020-4724cc589472", "comment": "Malware payload", "value": "23e7f48b5591cd529801574afbd420eef4221e89", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881359, "uuid": "dd358936-b63a-4215-9efc-9e90e5a34f49", "comment": "Malware payload", "value": "f83105c4ccad4d4a33574bb2d9fc77714b1d50a2dbc746dbffc709a39fd04b09c46ae2250d2a342a1d0ad3be7b8701ef", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881359, "uuid": "5c633bda-9585-4105-a507-c15c41a6d7cd", "value": "T15A33C75AB79AC846E6552B360CE6C6E9B336FC416F5B83073244B73E1FB5690CA03607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881359, "uuid": "7531ee64-e067-4879-a842-61a0b2c9f439", "value": "1536:gCDlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0h0KJJMNB6GciHf:gCDlYkEIuPm3fNRZmbaoFhZhR0cixIHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881359, "uuid": "44aa324d-3659-4188-aa89-39ab1d09ea6b", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881359, "uuid": "1b06f0b0-c339-4bde-bbf2-92d51c939dad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881359, "uuid": "1a78b454-1352-4b4b-9899-5cb4f866a941", "value": "RIMESSA_CASSEGNI08002023-4286.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2022859c-a7c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675870060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870060, "uuid": "2737a555-d2ec-4508-ab82-27a41bc75b99", "comment": "Malware payload (Amadey)", "value": "678d49d7e9779f9854ea3bf337ece187", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870060, "uuid": "c9fbb045-1930-431e-a6e7-061e804e600e", "comment": "Malware payload (Amadey)", "value": "6e6eb587d3457c85baf26318d0d335cd748cf2b87e53fd1d8bf2ad78ae39a82c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870060, "uuid": "f1c40371-ffa3-47d8-9c8f-a8993b5a794a", "comment": "Malware payload (Amadey)", "value": "fdd67c55bd71548a82a3b334788ebdad834c7218", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870060, "uuid": "7a776f6c-94b2-4502-8a01-851fc1245222", "comment": "Malware payload (Amadey)", "value": "a997011276ab9e242242759bc44299f92f40b4fdb7a26a6d0cf793f5de029a737f517939c7f05d45aae3356467b175c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870060, "uuid": "d731c34b-e103-417b-a0bf-b9dac587c4ac", "value": "T1CFC4020BE7EC8426D9A4677019F703C31A367D615A3486AE335E6C5F1CB2678E23136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870060, "uuid": "785a7145-4ae7-4534-9536-46f26f586051", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870060, "uuid": "16145c62-1b66-458c-8869-b795c0d46cfc", "value": "12288:rMriy90Eni6TwGZLVPxHC0qobuZmCRBFzyv:dyHnVTwGZxP7qobxu+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870060, "uuid": "4e1e7a3f-4a56-4823-94b3-0d830eca2db0", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870060, "uuid": "c6818e4f-e2a4-4911-94da-4353af00ba7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870060, "uuid": "d3a705c6-5cb3-4569-a865-75d34cf668f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee580c5-a7af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675860931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860931, "uuid": "38ee2218-466c-4ae5-82c9-02b46df4b36f", "comment": "Malware payload (Amadey)", "value": "c884af0724104bf27898e2e5b9f1992b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860931, "uuid": "a7f1efe1-bd87-4687-b578-bd0dd4f88a11", "comment": "Malware payload (Amadey)", "value": "6ea8b4dc5926e939ece89c791b66527ddb068364684bc586a599fec3fd7a2d6d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860931, "uuid": "84cd46d9-d909-4528-a73b-0b71135bb6c9", "comment": "Malware payload (Amadey)", "value": "e745c9ad11d2c08f7e4aa1e5cfa39f6943c54601", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860931, "uuid": "483adbab-b60d-45c2-914e-676dd7284637", "comment": "Malware payload (Amadey)", "value": "4ccff10742fa8d74fdc629eba664e39685b9ff7039a881bbc5b6d904fecfd0c30e7560b0bed2f6fe32a2df4ab3549a3c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860931, "uuid": "4282cc81-3da0-4bfb-a882-98c890f68443", "value": "T1F4C4020BE6E89132F9B057B028F303D31A367E901E758367634FAC4A18726B4A57577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860931, "uuid": "178f3c18-1af8-44f5-ad07-717e40b7c9ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860931, "uuid": "aae2b5d8-f2e7-4300-977a-d0e5307dbd23", "value": "12288:6Mruy906PBIjqCAIUacpIpdhq4Y8CPxZl+VJEUNp5aLH:8yLPmbAIUTa84YF/+nEypYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675860931, "uuid": "d5868557-d92b-4162-81b9-dffb16551e43", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675860931, "uuid": "96734ff9-7103-4417-919a-f389efa07da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860931, "uuid": "7db24b5f-e16c-46db-93af-eabb9098bd77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a38edf-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675882141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882141, "uuid": "928b1600-5620-442b-b029-da4cd9f8a1b4", "comment": "Malware payload (Formbook)", "value": "316b45de9f4287cf05c139b8603daf2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882141, "uuid": "76fb8fa6-55d0-4842-b03e-f64622c98a1e", "comment": "Malware payload (Formbook)", "value": "6ed1841d8da5de23418d6537bd4113571b5978b5ea1199b33b24efe09d84a727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882141, "uuid": "4a6dfc53-5fed-452b-91c0-6a28cb5bc379", "comment": "Malware payload (Formbook)", "value": "dad0208c0e1c51ec5108403a2742163185769e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882141, "uuid": "532d23a4-a254-4c06-afa7-4876fb00105f", "comment": "Malware payload (Formbook)", "value": "97f79db3cd81f331451c746e4010c7ebdea96324ec223b6e7c30914aece18b3cd063a040e575fed4660a2ee75cf4314c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882141, "uuid": "81ffdd4d-6254-4056-bc0c-782d6188a9ff", "value": "T1872512612210DAA4D52843FDC8B19AF093B93EF9D964EED72EC17ECE3A317A150506C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882141, "uuid": "5fe65590-e338-45ab-b3c9-b3aaca856833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882141, "uuid": "7e61f75f-6930-494f-858b-9665ca64adef", "value": "24576:F1bgzPGhgzfYPwMYeb8RJVsr40T1E1Fud+:FZyPyywPwMYegR/y4E1KFuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882141, "uuid": "0dfe5ed0-3219-4361-837d-410c38a90ab2", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882141, "uuid": "bbcaff6f-db90-40ee-b4e1-03c669464ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882141, "uuid": "36c7bf5f-58aa-4874-9790-132dab6afe5c", "value": "NOVA ORDEM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b742bd-a7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855757, "uuid": "dcabaf29-ae66-4015-ba49-67b01d7d7211", "comment": "Malware payload (AgentTesla)", "value": "e7a91dbb9d73acf1ae8c4afc6de9935d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855757, "uuid": "ef549732-95c0-4373-9eac-477c5786deaf", "comment": "Malware payload (AgentTesla)", "value": "6eeef42e918ab4d8f397fb2f5d76f5dde61cad084fa0a3b905a484edf0867b93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855757, "uuid": "bfe6a61b-0fc0-4361-ab30-576ce884b4a1", "comment": "Malware payload (AgentTesla)", "value": "850f376ff9662ccce6e06147a30ee7a0f539103e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855757, "uuid": "0680860c-19e2-419b-9812-d2677842b9d2", "comment": "Malware payload (AgentTesla)", "value": "cbeebee175a948daa72ac3f85f1a47c9cb269227bc599d8de2d9710edcb3035ad9399c9a74290ee6e92ace0881500279", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855757, "uuid": "48ecff9b-8dac-4db8-929c-c3129e201164", "value": "T163E4335F68802B771E19EDEEAA03C1737985270DC43E9120EE0C67F9B179372DA4C966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855757, "uuid": "ad34ea77-be5d-4149-afca-3994b186df3b", "value": "12288:s8Kw2mfV92wqcxRUoX944AOTc8wSCe/Q1Wu556Cl2JH6BOPqLGM06fDq0NP2RRX:DomjJrX44RBTCee96hJH6B6O906fP8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855757, "uuid": "e02d1bd0-3387-429e-ad5f-07ea937d0eee", "value": 667954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855757, "uuid": "c217ef7f-e167-4243-8c22-3c8443b00e44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855757, "uuid": "fef50185-fdd8-46a5-8eb3-4bb01a22a497", "value": "SFT098-434 COA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb568037-a786-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675843262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843262, "uuid": "6a182e31-6d4a-4562-b400-e3f83f940c78", "comment": "Malware payload (AgentTesla)", "value": "78946da530c865cb827a446747b1e3d2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843262, "uuid": "83ed3d4b-8f5e-4e12-aad2-d9edda3f4041", "comment": "Malware payload (AgentTesla)", "value": "6f63e699c4e15b9d609a0c4a7a45e8a8e76d7b74563e9048b08da779231341de", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843262, "uuid": "71e19909-6692-4720-88a6-707733f102c9", "comment": "Malware payload (AgentTesla)", "value": "48273016acef740afe2899bc68a486158394e414", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843262, "uuid": "3a073816-a0c3-47c4-bb76-293ef79af3c8", "comment": "Malware payload (AgentTesla)", "value": "13741d89b02430c9d93ee87cba9bb7d41a085d523a5ce7cf255c48ecf20bfa3f4dfc1a05b4e60a972adacbdda5ca00f8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843262, "uuid": "309b37b9-ae2c-4008-b120-3ef40bb6de8b", "value": "T1C48423B412E3558CC5800E7A6945D6FBACD40B28C344DFD586A9DE23C8629E76C8E7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843262, "uuid": "f260707a-2277-484b-a509-1cad464d5831", "value": "6144:osOQz8EQaRQI5opoPsi5TC0mHbAl6AVL78sk0Q3+QQ8It2D14dgIDoJ9eAgTWKqv:osOq8FI5o2P/5Tf6b8V8suPIt+Gdg+6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843262, "uuid": "190e57ae-e311-4169-b607-ebcb0b8864d9", "value": 378967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843262, "uuid": "0c95afca-0583-4629-af58-8d2fde421265", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843262, "uuid": "a8baaf08-be13-4b4f-8dac-2bb976290b37", "value": "Swift_copy.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d705d600-a7d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675876380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876380, "uuid": "30a8dcfc-af0b-429d-8b63-c53e480f28d0", "comment": "Malware payload (Amadey)", "value": "c91f969162f0e2bbef7fcad43f5fa5fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876380, "uuid": "9978e76d-3d96-4814-9972-069758d00b8b", "comment": "Malware payload (Amadey)", "value": "6fa1ef9c21ed2a141243146d101868ca20c5aa170a7761ff1bd3b90138cb31ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876380, "uuid": "25ff26f9-c5ac-4b31-be28-0d39923c171f", "comment": "Malware payload (Amadey)", "value": "c5a7f9785b803f24cef47aafa78314a159ad13d3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876380, "uuid": "ab82d7d3-1746-4fc6-aa1e-dc45274e383e", "comment": "Malware payload (Amadey)", "value": "2071b4f80bcb305d9202ee3efcb3eff5bd94c042e7dbc1b286c8f9835290e158e21eedd7876639e2e6cab186008f034d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876380, "uuid": "563be2bc-910b-499e-8190-12e613e0d4ce", "value": "T11DC4024BB6E89036E8B067712DF612C30E367D605A79C29A278B5E1F0973670763436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876380, "uuid": "2b984db3-cd34-4df0-8f06-f94d75878aab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876380, "uuid": "d5c2aec1-10aa-48ad-9eae-e33382992f0d", "value": "12288:yMruy90OgdakZMh1aPlhqPKokhPUmz4y6DW:EyoVMbaNghkVz4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876380, "uuid": "7eca9ad3-567e-415a-b67a-e5cc2ff0aa0d", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876380, "uuid": "f15ecf51-7162-475a-878d-51a39bafe841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876380, "uuid": "a93c8a91-e874-4dc0-98b5-ba719556a9e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0848cb27-a74c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675818051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818051, "uuid": "0389ee42-69df-4e45-b976-8ce7a09a4301", "comment": "Malware payload (Amadey)", "value": "8b9bf066342016d3f08b3ab8aff20b43", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818051, "uuid": "7187ae90-2fae-4ce0-a667-75cbc3c3440d", "comment": "Malware payload (Amadey)", "value": "6fd7e5bb8db4214396bfa514f53482b63157822ce4dbfff4f3e796c4a946e032", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818051, "uuid": "1d598d4b-e352-4d94-a019-f2b61d18b40e", "comment": "Malware payload (Amadey)", "value": "14ef193982d9696bce18e55d51de9e55d773fb72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818051, "uuid": "85144ad4-ff81-49a9-84d9-99c9209a74c3", "comment": "Malware payload (Amadey)", "value": "7de293134eadd414870724113b642d201489cfb3c4074119ede29462301fb4cd09daa128e2ddf3779ab1425e30e925f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818051, "uuid": "2ac8bbc3-2ff8-4d44-a8e4-6e3fba913557", "value": "T14CB4021BA7E84032E8B513705CF643C31A39BEB05A38875B174E9D5628722A5F77137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818051, "uuid": "79768c5d-33f1-4d5d-b90e-3fce455f41fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818051, "uuid": "7d707b99-a231-43a9-9c1a-cb7de2093f34", "value": "12288:cMr1y90tc7K91LZdXJVkPR52TJdd6cXWtg+VVxZl:By8cW1bXJVkPbg9PXWtfxZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675818051, "uuid": "d2ea5c3b-4562-473b-85ff-4b35fa9f2381", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675818051, "uuid": "022eb04c-4ec2-44f8-9956-362d176dcb37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818051, "uuid": "39b37c13-6090-4830-bcdf-1648b249ed46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a73233-a764-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675828591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828591, "uuid": "6f6acce2-9eae-4418-abf0-9e46b94b7c94", "comment": "Malware payload (Amadey)", "value": "a47cd7802edd6b834ca8374756ad763f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828591, "uuid": "140552b4-48ed-4716-815e-161367c69161", "comment": "Malware payload (Amadey)", "value": "6fea3609a064d964f3f1b7d2a5773dfa94fca0db909f8c8afdfb37fd210541d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828591, "uuid": "d45edf2d-3431-4816-b4bb-208b398a90a4", "comment": "Malware payload (Amadey)", "value": "c07f9018a02c07655c19b22001e29a337de85c66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828591, "uuid": "89a05766-96bf-4f1b-8b68-4a581d39f759", "comment": "Malware payload (Amadey)", "value": "7aceda7c71bf1fd4153f6169cd01e6b0702821faf667f2fa3d4d1e9ce5b7cac6dee6333671ead1fa05a2f61e661f06b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828591, "uuid": "9da92324-8e6e-4526-bd5a-e8290f6422fe", "value": "T183B40207F6ED8423D9B517B01DF703D70F363EA06678436B228F9C6A49725A5A27072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828591, "uuid": "717bb4e4-a896-4988-8ff5-e7561dc3fc65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828591, "uuid": "ac29bdac-dc0f-4362-b2e4-ddb3dad446a3", "value": "12288:9MrPy90Qv+AuPm2hgkw5EC5sAopRwR7B8lYsZ5B:myVuGkwS7FlYQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675828591, "uuid": "a845ce3f-a7b1-4acf-9fe1-011d53a8a5cc", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675828591, "uuid": "bbcce537-95af-4873-acf0-8783e44d4ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828591, "uuid": "5d974be9-7189-4a3c-803e-7e5f8408c4b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be709d6-a779-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675837385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837385, "uuid": "f10a831b-0e41-41c2-88e9-19957018ab79", "comment": "Malware payload (Amadey)", "value": "4e84543a9eb7e182e184e65c2d4c10a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837385, "uuid": "b036363e-da87-4540-aff6-fafb5ee749d9", "comment": "Malware payload (Amadey)", "value": "6feb523bbf2821803475236c4a5e418ed82a31a90e6062d05c77d335d4d18be2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837385, "uuid": "1e47ca95-616d-4da8-a64d-e83a5a4f6507", "comment": "Malware payload (Amadey)", "value": "4f1a2dd9f2d0e350608fbf5ab3261370dc194eea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837385, "uuid": "a221e36c-f432-42fe-946c-47cc941ae925", "comment": "Malware payload (Amadey)", "value": "1972b6930e8556a104d43a23eef2232dab2e76a643a0f6f33fccf09b0b1a8dcf050ff7180c56d48424bcc7896c48d95e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837385, "uuid": "285ff980-ba35-40d6-84e4-61b83a7073e8", "value": "T10BC40207BBE58076FCB1637018F602C3053B7CA15778979B138FA9AA18725B5A6307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837385, "uuid": "894cac16-0fea-4a56-8b12-b40da75b13dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837385, "uuid": "5553ec81-89fc-4178-98eb-e32c57855840", "value": "12288:BMrWy90sB/lO1rnIQ6ZEdHuLEJvopkEzrOVcPww:Xyn/lOhcm9SE1yWcYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675837385, "uuid": "97055f41-3860-46e4-a75a-1dc77fc019aa", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675837385, "uuid": "8c90aad5-b519-42d9-b781-cafa251e2554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837385, "uuid": "27e87f37-050d-4574-a5a0-9f8eb5b852ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7a88ff-a7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675875180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875180, "uuid": "e6ab1a59-2d42-402f-8ea0-36fafb381237", "comment": "Malware payload (Amadey)", "value": "04a19b34dbecab8e392820f17c835405", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875180, "uuid": "43886178-5c5f-480d-a41d-144c9fb9cb38", "comment": "Malware payload (Amadey)", "value": "70686ca47c1caad10719f3c8afa4cb8d332eef9cf2e5f503ccb63b7568e48b66", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875180, "uuid": "9cb638fe-8c09-421a-aacb-1a4ccab0527f", "comment": "Malware payload (Amadey)", "value": "e306110b7b66a7a60f1740b8eed280559599fc50", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875180, "uuid": "626cf09c-85f1-4867-b368-9d74fd40fb32", "comment": "Malware payload (Amadey)", "value": "446ca1ec12e808999b1e60f5ee8de91cba6979b1d44663ff5136717301c00fc2910d21a8ca86eb58d9e74a38d0bdc495", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875180, "uuid": "dfcfdf31-b07e-4fa3-96ad-1497703c2a1d", "value": "T1A4C40247A7ED9022E8B0577058F202C30B367D511B79829B13CE5D9E69B63B0B9317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875180, "uuid": "30ab6c43-0a67-46f3-becd-31f90663ad9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875180, "uuid": "43b53a35-8d47-47d6-a9a7-f848f2def71d", "value": "12288:MMriy90C47peYJIAi3bBrEwOOpoKokhPUmAONobL4uj:uyg7pedAiyO2ZkVA/Yuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875180, "uuid": "9ebc0d79-7be8-4ff9-866e-97464a43dfd7", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875180, "uuid": "fc51bf60-01f4-4dc7-ab99-a09d5c4889c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875180, "uuid": "dad918ff-3e26-4921-8746-9fae70275877", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34217ec7-a7eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886415, "uuid": "cba6a302-2bda-43ea-a430-4f03138dab3b", "comment": "Malware payload", "value": "1e512df0f26079e52376064f1a7ec019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886415, "uuid": "3c10ddb1-17f1-4d8c-beaf-14b7425a7769", "comment": "Malware payload", "value": "7083c049037004acf270e8ce3f6bb25c502d8df38aab9e3a3cbd131444478cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886415, "uuid": "5edd0465-4cc9-48be-8ae6-da99b4b961d2", "comment": "Malware payload", "value": "858a5465ed0f9fda9ab35945e765c44abcc4f230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886415, "uuid": "ba01e9f0-175c-453b-ba89-04d554ff163c", "comment": "Malware payload", "value": "8ebaa153f842dc9bd5ddb8a8946b54a1826686915d94508d52f5551c4175a0c3b80b4cb3583b1b0ef5c12f02b0da6f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886415, "uuid": "587ca7ee-dff7-40a3-a2cc-14c48d0da829", "value": "T10C64F903D2E17C81F9568B77DE1FFBE8B65DF9608E4AB7653218EA2B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886415, "uuid": "4c48a29d-d0a1-4f77-b778-2c3a5abb10da", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886415, "uuid": "dd16976e-dcef-4a9d-b211-992e37c5cce5", "value": "3072:oPgQ/NddxR9DMe4Cpk3gD0ooHGiylyUIx705sXos5vsWQDiuLpp9gv:orDrDMcC3RCyUIx70uXOLiqkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886415, "uuid": "44634647-b034-4fce-81cd-5cc3588e33b5", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886415, "uuid": "f418880b-a84e-4b0a-8d1e-8cf1caf38041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886415, "uuid": "28837411-600b-46c7-b6bb-5339f4a5205b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef403cb-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885332, "uuid": "f8094030-3007-4141-a8e4-2a608cc74134", "comment": "Malware payload (Mirai)", "value": "b7e74fd68df46cc5ca54f2606c52d233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885332, "uuid": "547a808a-ff16-41d6-a095-bec9b082ef2b", "comment": "Malware payload (Mirai)", "value": "70858065a6d9a4427e247501694fbf91dfef64d30af19c3df6cf5f45660eb571", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885332, "uuid": "7eb0a54f-0c5c-482d-864d-593f29162565", "comment": "Malware payload (Mirai)", "value": "f9b62a8e77465e09f8c2ec5f17103301af9225d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885332, "uuid": "9d5fadea-5e80-4e16-857f-00597c73be09", "comment": "Malware payload (Mirai)", "value": "8519c90772a7cebc56ff9bd3ddbe6a28cb72082792bab19df1b091ba779f47d00b8485cd1b83d4bda79a79b183e6005e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885332, "uuid": "ed492797-a45c-434e-a0f6-daf3615892a2", "value": "T161534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885332, "uuid": "5a4fc436-cd36-45b5-bfc2-df8d804531d6", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/aGV8+BCpEMsW/J9KCrMvuBxANUr6FV+tMiwWZIS:MvolWm+bhBgd9KCAWBxANee++bWZfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885332, "uuid": "96901d61-2b49-417d-a653-6583e2a76d60", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885332, "uuid": "7b294a64-74f8-4000-b26e-518b800b4d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885332, "uuid": "d78341af-3ce1-4e7f-925c-557e7f4c88ec", "value": "b7e74fd68df46cc5ca54f2606c52d233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d00e1f-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880921, "uuid": "2b17c45e-8315-41ac-84d8-dbf9928a0fb0", "comment": "Malware payload (SnakeKeylogger)", "value": "8d5baae6f5eddcec43c3eb39fb24876a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880921, "uuid": "284d8336-47b9-4e33-a9fb-7f8ccce9bb0e", "comment": "Malware payload (SnakeKeylogger)", "value": "70a7efe1243bf19fe90d69007c431c9793f9ef20eaefdfa19c14a77b5813cc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880921, "uuid": "e1675753-3fc7-4a03-8b0b-b36e40e4016f", "comment": "Malware payload (SnakeKeylogger)", "value": "65c19c1470f2b96fea30441a46d5ba75d0270338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880921, "uuid": "71cd11fa-16e7-41d4-9f19-0c9d0e008eae", "comment": "Malware payload (SnakeKeylogger)", "value": "cb14568821df2a45d1b5d17ed6f6dec27af85d1f5c397432c4cd6e89f954c48b3886529846b47440cf904ebd74c30c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880921, "uuid": "2c643e47-3003-4a8e-b0d5-548cc8706e3f", "value": "T19E5412182620E4B3DEB219727D3901D2BFE6F92325A9519713A01F997FB6181DB0E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880921, "uuid": "830d4a7c-4e2e-4cc0-a06f-e5c4a630ca54", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880921, "uuid": "5dd1b014-6e50-4e97-9c35-ae4ce56a8d57", "value": "6144:/Ya6GQf4F7s2nT1iHXkU796Q9fZ/LfrLSw4DKKKT3p0hXcQ/lgL:/YIQS7p83PcQ9fZbrGw4DK30yQt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880921, "uuid": "d4e24487-22b6-4563-955e-bf4de54912b2", "value": 286170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880921, "uuid": "1d00fd6a-088d-4383-aa12-d707a432718d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880921, "uuid": "e68e0214-7282-4363-8655-2bacdb30a9ee", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542213f1-a7cf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675874442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874442, "uuid": "cb00dfd3-b529-4aa8-a28e-2078c466246c", "comment": "Malware payload", "value": "4f1024e88cea6dbddfa8e88795a59695", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874442, "uuid": "9e8816e6-eac3-4870-8e94-d348f7f721e0", "comment": "Malware payload", "value": "70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874442, "uuid": "7f18f234-d89e-4267-9d83-04b66942acaf", "comment": "Malware payload", "value": "13817415ad9d42bfbe6868d5965a8c39c12ac737", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874442, "uuid": "22fd8300-b9ee-45d0-b259-8f941c58564f", "comment": "Malware payload", "value": "db2aed7d7cbc74d8c0e9384ce9e4335fa3cf8434600cb51eef5f34a478ce1425ed1407cec845d2e4f8273ab4dcefcbd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama238", "colour": "#7B6F3A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874442, "uuid": "04576c44-aa25-4704-8a90-814a4d5924b2", "value": "T1DA646E16A60398F6C85736B31297E1DF3A34E709C4105F5DDFF81C24FBBA900A5B926A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874442, "uuid": "5d3d5e22-9bab-491b-878c-68d78affbbb2", "value": "0cc8ba71b98afd867de0195f0d6030f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874442, "uuid": "7bfacd1c-4a7a-4213-b780-c75b7bb88953", "value": "6144:z8HwSJZ88IKeVSi5CHvJITRTcKY+UC6vmtmHkRCTZHmR/UYSbO28m2XQ9MW:z8HwSJG83i5CPqTCKY+cOB/UnbrwXQ+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874442, "uuid": "9ed3a926-bc04-4f7d-b6c3-e2cd22a79ccd", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874442, "uuid": "8f39ed2e-8ee5-4e9f-9f47-9255dafdbc6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874442, "uuid": "528f01a5-9ad8-488c-9ed4-57801e3089cb", "value": "780683.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8b4a07-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675882058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882058, "uuid": "9fa14f67-d366-4a76-85b1-c555a9f271c5", "comment": "Malware payload", "value": "fa734c250b5aba6950aee2fa5bb5a7ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882058, "uuid": "4d50083c-ac2e-4cee-ba52-67aa5b7ca257", "comment": "Malware payload", "value": "710222dd06b5863b7e023cc3ab2a70c7f655c8356616b6e7b0423341523adb20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882058, "uuid": "cf758695-6777-4c82-8d52-043ad1b1004e", "comment": "Malware payload", "value": "6e46814c9686d6de6b737d59db221451a855322d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882058, "uuid": "ff7cf69d-bc0c-4348-8356-c89e94d6b77d", "comment": "Malware payload", "value": "a9b06ff7a981d3f8442414c27eac154b9a2f5cee1e279250f03d164b5cdb536c776d0aa87c13c278c6b31d260680293c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882058, "uuid": "bb6df629-a508-4d1b-8f02-c9bc6ea6a0af", "value": "T1F9150697B89480F4C0FED124C666A213BDA134D9073477D73BA186E11B66FF86ABD324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882058, "uuid": "6a8ac128-4cf7-4617-ae23-ba413070a000", "value": "12288:jrHvw1dw+7VwLYCxWzFOvHvljC5z+UEzsM9t9:jDI1dw+OlIzFyHv1C5z+UER/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882058, "uuid": "b1b90c67-0d54-4a88-88f5-7a6b06c328bb", "value": 956859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882058, "uuid": "6057cde3-ee2a-4193-ad4c-43ee50387133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882058, "uuid": "50cba5f3-4574-4938-b0fa-0bfb513fbaac", "value": "fa734c250b5aba6950aee2fa5bb5a7ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3deac8d-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675881502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881502, "uuid": "b78623cb-d40d-4454-a823-040382bada47", "comment": "Malware payload (Vjw0rm)", "value": "e55ffbc87d1b5a8b7b6b97d2d75aea7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881502, "uuid": "63e56826-5c15-49a9-997d-33b1d4158bb6", "comment": "Malware payload (Vjw0rm)", "value": "7212024ec92f9bc4867ffbf22c146196ed32baa4321f4c46f778a38d2cf12985", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881502, "uuid": "737ebdb4-3ee8-48cd-ac3f-6a4b143e4814", "comment": "Malware payload (Vjw0rm)", "value": "880ca6bea076d325344edb38d37750fc58735c49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881502, "uuid": "981c7994-9acd-4802-8ab9-69dc336fae0d", "comment": "Malware payload (Vjw0rm)", "value": "84c91505f2a89f7010c64ab2385e47da0d02135d127e92cd4b77b75aebffdcac61d52339c60215885421fa8ec1f8501a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881502, "uuid": "e16295ac-8335-45ff-8d11-714bb3928615", "value": "T17D71109C2C5B863843D27B8A801ED14CCDF548B47F28D2B2149DDAC5360E9B987B19BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881502, "uuid": "d5fad5cc-a0e0-4fa9-a506-6746d61a4cb8", "value": "96:SABNo5D0k2c24ZRMHXE6/BIL+Ys+fJZTDdQqR7bJyKh1vUK:zSd2c24ZRMlBIaYs+fJZ/fRfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881502, "uuid": "29ac2305-7162-4807-9725-84d47ad37310", "value": 3774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881502, "uuid": "762ae640-7f3a-45fd-b508-a914852334db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881502, "uuid": "dbbe7b61-6435-4c29-8d6e-825e6655a425", "value": "IQ02072023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66c5091-a7c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675871601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871601, "uuid": "144ef6ca-df21-427d-99ed-5691bfe5ec08", "comment": "Malware payload (Smoke Loader)", "value": "b91a92ca4fe76a69a8ba5e8c39fe763a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871601, "uuid": "3ab14c06-59ca-4985-b6e7-fe97e06a604d", "comment": "Malware payload (Smoke Loader)", "value": "722fcb0c1d0bfce7405eb8f398af5609c3d5dfa7dd81c910268a15d3684b7b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871601, "uuid": "ee24c3e1-a359-452a-a361-df02fc853b05", "comment": "Malware payload (Smoke Loader)", "value": "bda775774a0ff51c8540cdc37b3166e2478fe23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871601, "uuid": "4db38ad6-18a2-43e2-8cd5-8ce399b9ba14", "comment": "Malware payload (Smoke Loader)", "value": "aea052a15755b65d30dbc23a2266fc10525c98ed87b4c04ffd82f371cb96de9e7c2baa27cc6728e9b2bb02abcdbb8fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871601, "uuid": "4e88fc7b-e58f-4329-b4fb-de33fab4de0a", "value": "T1B864398397F1FC42E9658A73DE1FCAE8721DF9508F2E77769218AA1F24710B2C163215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871601, "uuid": "7d15e2c9-d65e-41ae-af09-1f6d4f27962b", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871601, "uuid": "2e5c702e-0c1c-47ad-827c-679b2d2ca0af", "value": "3072:aP6SWIKRN7ohidVlVjryr26CA1xZyMrYPTvRLStKRxhUwaZ7hp9Jm:aSP973JVARyMr0TgtKBo7HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871601, "uuid": "041b2b0b-6cdd-4251-8636-36823f207d95", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871601, "uuid": "bcfd1628-21d2-4a41-b1bb-2f8d7c07dc8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871601, "uuid": "761db6fc-cb51-417d-a094-a4f8042126d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aeae306-a772-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675834457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834457, "uuid": "f4a770bf-5207-4a1a-830f-1068ced1f652", "comment": "Malware payload (Amadey)", "value": "f52a0bd187425ea34e0e57c3f989674d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834457, "uuid": "9d145a6f-204a-4f2e-a2a4-dbf2466d6545", "comment": "Malware payload (Amadey)", "value": "728680d2b009f96df9c5cc0d867531f437a54352e0e66d67fe2269d0df793cb5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834457, "uuid": "7dc551e8-0e94-47fa-9340-4a018f626d2d", "comment": "Malware payload (Amadey)", "value": "6d21e538eaafbe33d2d5ed1eaa603988edf37744", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834457, "uuid": "6620b4b0-4e8a-4345-b307-5b97133d93a2", "comment": "Malware payload (Amadey)", "value": "6ae27e99dfc839cba46f4bf53c6e3008e9b324af453c0745f7a88d78c7b3625a05aefa95e0d5cebef4b7de835d65a576", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834457, "uuid": "93a765a8-f182-4661-96a6-ca80533b3fa6", "value": "T14FC41217ABFC8022E9B06B7019F602C30A3A7DB1573483A7774E7E5A1DB2664713176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834457, "uuid": "254094b2-5220-427f-b468-d19fca218e9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834457, "uuid": "a96c61af-5596-4c6a-adf8-167f75d8fc76", "value": "12288:0MrAy90pSjNt5CpUDJUrdAJBvQLMy4xVAggiXXL6dvpK:kyfjNKUCrdQ5QLt4wCr6dBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675834457, "uuid": "4e0be8c2-0751-4ad6-8966-15e78f6de4f3", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675834457, "uuid": "e7ed9fa5-706e-4409-bda6-fbb0c1310d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834457, "uuid": "d83ef79c-f1f0-40d5-8d96-ab18cfce0b04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bb427c-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881081, "uuid": "64444680-b94e-4298-a6e2-6ebbea13082b", "comment": "Malware payload", "value": "eaafa6deb68b226f5bae82cf784160d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881081, "uuid": "191e98de-8422-4035-b5da-976c34d3b10d", "comment": "Malware payload", "value": "72995c876927acaea4763d8d3a1c70f2dc69b3511f0abc1957965f5bb90a4978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881081, "uuid": "cddc1d50-ad56-4d6e-b6f6-82431b2a45e1", "comment": "Malware payload", "value": "98cc40eb02b4c67e0dc7ed8bb33d0bc8aa2ffbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881081, "uuid": "2d30981c-76ed-4f8f-8d90-1a2ed70c1cbe", "comment": "Malware payload", "value": "a405ada56910462b50c2692e81fe8c0833de57ac9d62923da0533e0df51c378a3966b566017b16ea0db7e224e40b936d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881081, "uuid": "652fdce8-e0c6-49f5-9c52-adf42ef8b81f", "value": "T1B895C4E8BD78C831D87B617A2AB4A718D5BBFDB2EB177A4D99421231048C17E4437D83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881081, "uuid": "5939bdfe-83f9-4ccd-948c-27dd1e9c2a0a", "value": "bcab1397e3956a9894e8595d7bb0e900", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881081, "uuid": "55e82886-6986-4ef8-aa53-1d00d48df28b", "value": "49152:m2Rv7/4p24eex7gZQENFyWWupo4C8kzD4vIp:dRWZNsUDV4C8kP4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881081, "uuid": "795c43d6-d0c7-4cab-8389-946e4e7cea5d", "value": 1926800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881081, "uuid": "48f76ef1-729a-4d0d-8ef1-2f5da772a857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881081, "uuid": "cd48bbde-4e15-4346-b3e5-b74c467f5fda", "value": "eaafa6deb68b226f5bae82cf784160d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b2c7ec-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675881391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881391, "uuid": "4e1c04ad-21aa-4be6-92e6-dfa09e18948d", "comment": "Malware payload (AgentTesla)", "value": "b7d6d9799d2986f398e906969a106e3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881391, "uuid": "e5c0ebf0-7c25-4c7e-84c5-a669ed9d5e0a", "comment": "Malware payload (AgentTesla)", "value": "72daa1089173c5431e8e1db09c1b4fd86bc7607c0990b254932cdea3a7b6d72d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881391, "uuid": "86106910-d7f3-448c-b5cf-d1649f3fe80d", "comment": "Malware payload (AgentTesla)", "value": "8839bf8281113ab0d411429cdc0a039d8e9dcd98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881391, "uuid": "b85717f4-9b58-484c-9249-78254535956c", "comment": "Malware payload (AgentTesla)", "value": "d7578cf5cbf92ff848ab3378bcb189db88ebcc3407abf1a46bd9efc215c067a6de2ed7b28929709bb622658d28c7a72d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881391, "uuid": "5794cd14-cddf-4fc2-b688-de80f4dc1f08", "value": "T14C348C47BF00966AE8550F3448F38BA61645FD046F120A0B3629F72DFDF16E48E3AAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881391, "uuid": "a73fa36e-8669-4c51-890f-314df1fee47d", "value": "6144:rtZ+RwPONXoRjDhIcp0fDlavx+W26nAq90w5exX1ok5b8/N4k5+:RewsikeSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881391, "uuid": "059e9a6b-6ac1-4176-b041-868a4c5ff4d7", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881391, "uuid": "b8e22a47-a01a-4e7c-825a-5d5357a0a36d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881391, "uuid": "09fe6869-7f87-4b2e-b7a2-6029f26a9637", "value": "Purchase Order 4000308887.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676927a6-a755-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675822076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822076, "uuid": "e2d153c6-2977-4b08-8126-b543935fd499", "comment": "Malware payload (AsyncRAT)", "value": "c7df24797804d366b83889f33c46d701", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822076, "uuid": "0814d62f-94cd-42b7-80dc-1a079ade0957", "comment": "Malware payload (AsyncRAT)", "value": "73275ce05b838c054ebafe2676101976c931f14e7090291cba45dc283c272dff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822076, "uuid": "7567f69b-d91e-4c4f-bcf4-b765d08113c0", "comment": "Malware payload (AsyncRAT)", "value": "dcb0fbd5c8cac210d404005ecae79c96479bbda4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675822076, "uuid": "dc0919a8-8e6f-4a4c-a8d8-7d74537df6e5", "comment": "Malware payload (AsyncRAT)", "value": "e80cd02951bfa67a950b3014174042bb4b68aa8b115293a3fe2f6ec4acf7720d58e7cc1b323113a0bb75ac9f203f5817", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822076, "uuid": "1cebd653-ecba-48dc-a1f8-b7c86849be60", "value": "T10B14D03236D1C072C47A24345864CBB16FBEB9314675DA6BBBAC17AE4F302D1563B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822076, "uuid": "21619430-f793-4f4f-b3c0-310ae868d87c", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822076, "uuid": "8a406777-5f7c-4c67-8c84-d50404351bae", "value": "3072:df8O8sLEfQDNALwwFWta5VCWxs1N4j7L7nm0qIEZXUOgrLAps:df88PaL7FTs1NkLSpIqKrLAps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675822076, "uuid": "6e3aa6e5-4e63-46f5-942a-32bce947b6dd", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675822076, "uuid": "9abc0187-8871-47c9-a42c-5a3e94f64dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675822076, "uuid": "0479b2fa-139c-4ec6-8363-1fdd4c7b39a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4a7dfd-a7f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675889062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889062, "uuid": "a757f57b-8e80-4263-9c76-3c7a28265fdd", "comment": "Malware payload", "value": "3d52d171523e07600e30ad60d67fcc45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889062, "uuid": "263eefd9-ba04-4b63-ab98-0cfdb10ed6f4", "comment": "Malware payload", "value": "7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889062, "uuid": "0ae8eb65-b1d4-4780-89ee-b16334ee8e8c", "comment": "Malware payload", "value": "a5d89cb745695d0c0d4b8116bdc9a7b892756b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889062, "uuid": "406ebf56-90dd-4220-bf11-a1cacf09364d", "comment": "Malware payload", "value": "3896da8f41e0aa2e6ee209ae50113f0c0655244273b8c7490fb1e85158e386b0f01fdbcf2bf3d60ded39d9d0a929e270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889062, "uuid": "dd48875c-c5ab-4725-88bf-97a56af0f5ac", "value": "T12415011B8EC2ABB6C9588230D77615D86BF18A4F5025FBE33CCE05ECDF9538A57024A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889062, "uuid": "48b7e203-dd87-45ae-b9aa-4efe2bd50e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889062, "uuid": "f2296b5c-d9dd-4afb-ae82-012a48c74e9f", "value": "24576:vuq/ZM4+TNTXYAlCDuIL0JIYAlCDuIL0rS:6TRIAl3u0JAl3u0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675889062, "uuid": "e43870bb-6e6c-4e67-b982-1ec8b20a2fef", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675889062, "uuid": "7773118b-124d-4a53-a11b-2dcf1d27cafc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889062, "uuid": "d7cdc91a-536d-426b-8c14-759018f77c1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53f4fc3-a784-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675842393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842393, "uuid": "9b7509e2-24f3-44bc-9134-5655d72829f3", "comment": "Malware payload (Amadey)", "value": "e314bdcdd7b77d3b74ed65dc9c1bd02a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842393, "uuid": "87607628-7505-4e7e-bd28-b3f8171165f7", "comment": "Malware payload (Amadey)", "value": "735c4784ea641625673d13b342591b6ef76cf7cb566ef22f5462529a89ce9795", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842393, "uuid": "54641de9-18d7-4acb-aaa5-d4b97137d0ec", "comment": "Malware payload (Amadey)", "value": "d4413704958b7eb04829cfd96e1a302384864407", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842393, "uuid": "084a0d63-9987-4ea5-b178-980492e17f33", "comment": "Malware payload (Amadey)", "value": "aba68924cadef076568efb2a50abbbeda2173c33e43f3469a91b3b7478e58add61e41080983a5ddcd61afabeff7b6bd0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842393, "uuid": "4843d70f-5a8d-48e6-938b-5914374033d4", "value": "T1C8C4021BE7EC9072E8B4577518F603D31A327E919E38879A274B3C5A14725B0B63237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842393, "uuid": "e221e2c4-1ccb-47e6-8458-7fd20d2966c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842393, "uuid": "efad38e3-16f5-41e6-a3b6-be747139b0e2", "value": "12288:WMrIy90VF/gM0YVx27JanlIdQlxdPS/8XDZoLsYQDE:WywBgMxVxwalIdQ5PnX17Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675842393, "uuid": "cb0e2234-b4c8-4573-9cc5-3538d144e07a", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675842393, "uuid": "bbf4375c-4fc0-4331-a977-2e073fe7aed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842393, "uuid": "890b25be-123f-4dc9-8c78-62c56ddf7545", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af76c1c6-a80b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675900366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900366, "uuid": "506f974f-e5a8-482a-9c68-8ffe5a6d5fff", "comment": "Malware payload", "value": "45cff374b17be461c33cc122b811076f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900366, "uuid": "fb06de2f-1970-4d73-b8c2-b7a5dead8ec5", "comment": "Malware payload", "value": "73a574cac3e9e540d4071c494bab32cdcae7adf3d0e9e58de138569e731896de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900366, "uuid": "833eb745-e3fa-4faf-97dc-c07ff9bbd968", "comment": "Malware payload", "value": "36d1d74b23f65e52625195fdadb6bff00948f276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900366, "uuid": "4f2a4351-08a0-447a-91a4-308a1874b3d4", "comment": "Malware payload", "value": "6b5778d5199e4160ef076f6559d7a7943c0678f86130f81ffdeb3bb215da033b23da6ed5e59ce382d5a4dba67c09d4c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900366, "uuid": "5ca2b90e-cd12-4d09-8582-b674771b420d", "value": "T1E8951203D2927D90F5268B769E1FE7E8768EB6318E4DB7793218EA1F24F0171C163660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900366, "uuid": "b1b547bd-9dff-4433-ad52-718e9de72719", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900366, "uuid": "ec0b2fbb-a2cf-48fb-8406-fd1bdf8c88ed", "value": "49152:jlXiz3SqE4zhlGAtwA3S/Q96vF4Tjxr0QOHwEZOpT/EcHp/:w2GzXqA0QkAVrdOHbZw/EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900366, "uuid": "af8843a5-3f75-41b3-823d-c88eab5f82c2", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900366, "uuid": "920af6c6-7037-402d-8662-3b30e7d35d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900366, "uuid": "3744a879-c685-4377-b8df-b9b4cc84ba68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b43c606-a74b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675817707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817707, "uuid": "09d5a47f-e6bc-43a3-8f7a-1dc9b7159161", "comment": "Malware payload (Amadey)", "value": "96fe703e10f535c354d48153ef1110d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817707, "uuid": "7a3ad1b7-857e-4d46-8f10-dcc00e7f589e", "comment": "Malware payload (Amadey)", "value": "73d57658091a76dc61d3d787141ad7fa32a307515744572617d6403bf3e7f411", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817707, "uuid": "b33b6e85-a7cc-43dd-aadc-33074ea3590c", "comment": "Malware payload (Amadey)", "value": "36b63ac4e0332764539a9b7d7fb2218a22c60d1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817707, "uuid": "a13d2fb6-b4f2-47f6-8b46-2a6f32face82", "comment": "Malware payload (Amadey)", "value": "2dea4bd02623119bdab827bacc19c79c011c1192ab5f8a89c5111a56e01e714bbec039e25bbacabb28c7a05d29e9452c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817707, "uuid": "9e43f638-2110-489e-bcfe-d81fb9338f37", "value": "T14DB4120BA7E88023E4B5477019F643C31B397D615A34878B378FAD5A18A36A4B63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817707, "uuid": "bc1a227b-6933-4762-a167-e491a7d2a426", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817707, "uuid": "4e9b7139-8738-4d03-b556-c035d343ef2d", "value": "12288:oMrKy90FmuUVTrmAm9DkPRm2WJdd6cXWtqt1Gwmm4:yy+IVTqR9DkP4l9PXWt0av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817707, "uuid": "12ceab3a-7f2f-4d0f-8769-a32588d8d09c", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817707, "uuid": "4005abb7-836a-45ce-b922-208db0f95d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817707, "uuid": "17f37dc0-9d85-40a6-a540-02dda991a772", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd50c7cb-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675881974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881974, "uuid": "58b9504c-c249-4c8c-baba-eacac2dff283", "comment": "Malware payload (AgentTesla)", "value": "b12ca3ce9ecadfa0d5924c6ea6dff4db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881974, "uuid": "e476e35a-51b2-41e1-9ac2-691ea416c6af", "comment": "Malware payload (AgentTesla)", "value": "74376bb8eb86e48492b6a1f365d9c2d9c7ea356b79ea40b2d48d526fd7004370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881974, "uuid": "ef997075-c180-49e2-9566-e4419d6d8c8b", "comment": "Malware payload (AgentTesla)", "value": "679b2867a10c391694d0f22a0b6294623d50bb1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881974, "uuid": "4e606712-54c7-4109-a962-a2e60a71bc5c", "comment": "Malware payload (AgentTesla)", "value": "a53f20bb057cc0e66573cf6d8536310e630471a46336299f98907695f5886ea70c67ba7893786c5ba6fff6c4ceb7b68b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881974, "uuid": "4f908a9a-579a-4370-a3f7-395dfc481c2f", "value": "T10885B000D92240F1F67558B28C99EB0CA838DA741DEB8357C7CB9376E69BB4C5DB490B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881974, "uuid": "96eb6449-c92b-4582-8170-0d5400e0623b", "value": "61ad665502ca1c66fbbbb4bc3ca6cb32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881974, "uuid": "6a61cb26-8045-446b-9140-f14284247750", "value": "24576:NXhCjrBbhoojuL1hy/B+aVt+JyBHujWHpfip0oedz4t2/xgy3NNCqSbju:vQd6ojgy/B+stWaHpfip0oek21NCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881974, "uuid": "6747048e-cd9b-48a1-a7c6-b9f6b387173a", "value": 1744016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881974, "uuid": "3f60f76f-7f59-4e58-a33b-2b70b1f21e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881974, "uuid": "5cbf63c2-2daa-4038-8fc5-a7bb0c652336", "value": "DHL ORIGINAL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e86516-a7cb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675872941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872941, "uuid": "ac4f3610-3aaf-4913-ae7e-0b4b7cf93706", "comment": "Malware payload", "value": "cb81982a505af3d253ded21688182a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872941, "uuid": "e312d206-e3ad-484f-9117-1c09b965422d", "comment": "Malware payload", "value": "7491b7df4111dcfb119f773fc503dcf63194084ab928a5cade2e363612ab7a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872941, "uuid": "c061b87b-658f-43f3-a577-510ded72bdc0", "comment": "Malware payload", "value": "88a3faa43b5da638f082d58a4089a6e270c7a792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872941, "uuid": "bb3ab923-6a12-4331-9e49-a56444cbbc8e", "comment": "Malware payload", "value": "1213f2e9fe0b679f8ffae0e36e6c599cb3b244c24b8c0c2b169a1c4c60ecaa963fc842a32c0d71225e4c2bb9d95c2697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872941, "uuid": "10fdf090-f898-4dfd-807c-e6e69ba8aa09", "value": "T1A0763333B8E9CC79E39390338A0D4EE514F4C2541A3A94D35398696A6F7DB325B247F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872941, "uuid": "d614f1c5-acbf-40eb-800c-8460df23c420", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872941, "uuid": "832bfb05-dee4-4aee-96e7-ad72c87dec6e", "value": "196608:91ONvN7w9hFREAP6TOUC00xB+Z6/pB3J9yKp7Xjc:3OzqZEbOUbs+ZCBHyKpzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872941, "uuid": "a8e75333-20a3-42db-a1d8-83941682d0dc", "value": 7584043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872941, "uuid": "aa1b7f86-dd7d-4de5-8b85-9ecf58a790df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872941, "uuid": "b73c05b2-ff8c-4fcd-ba63-8f7903571a39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46278c21-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675881291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881291, "uuid": "5fc3d64b-fde1-4fd7-8932-129cb94447bb", "comment": "Malware payload (AsyncRAT)", "value": "3a83c646f577b976e94ad8781fd3b09c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881291, "uuid": "738ac6d2-d075-4baa-81df-519168622ce7", "comment": "Malware payload (AsyncRAT)", "value": "74930b91b8999d03db3840b121fc52d0f5fb6d4b9158b950a5e869aa84a431f2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881291, "uuid": "73e1f804-212a-4925-bba1-84246bfab2ba", "comment": "Malware payload (AsyncRAT)", "value": "44bc051ae629cffd74ea42222b19f93c66121a9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881291, "uuid": "79bafff0-840d-466c-bd58-1b25b7d22cc1", "comment": "Malware payload (AsyncRAT)", "value": "97587a3c9e5d561ee24d243fc796c5cc7acfe6ea1957d4c674a8aa59c9110f83fb142111b46de92a1fc84352b211cdef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881291, "uuid": "081ffd4b-2998-489d-b8c6-e66388b7d28b", "value": "T132959CFE31DFF220D65E01F9C76B9AE550D878A9F13380575D70E9259682C8D8EBC282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881291, "uuid": "b2d3364d-affb-4c76-a47b-11a605b9b51d", "value": "7a7a9ac40cd670433b285ea5ed2b1d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881291, "uuid": "6cf7f0ec-5708-4906-9884-dbf5327763fe", "value": "49152:HUJb2kgSccMhYN19u8PoK66JWyfkrKQ8F:0JJgSBMW19u8166IyfTQ8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881291, "uuid": "ec1799bf-4a7f-49c2-ae71-a63190a3ea97", "value": 2005560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881291, "uuid": "14888266-20ae-484b-a8fd-a7a34a092f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881291, "uuid": "955f4365-f189-4a3a-9469-5b85a20c9a1f", "value": "3a83c646f577b976e94ad8781fd3b09c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476dac15-a744-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675814721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814721, "uuid": "4a2ca72f-7c9f-4e22-8e40-9202d5d20ccf", "comment": "Malware payload (Smoke Loader)", "value": "f8427b08ac727626627e7bf690dba7dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814721, "uuid": "e977213a-aea3-4a82-9340-944a18b1cbaa", "comment": "Malware payload (Smoke Loader)", "value": "74ec7188361182f24301003f9d156d6a9b4dfb438f98731c5e525c782763f978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814721, "uuid": "84a57197-bffc-44df-9132-40137a91bf7f", "comment": "Malware payload (Smoke Loader)", "value": "835ffec5aeecde9838755c789abe576eb360ea59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814721, "uuid": "914c7380-abf9-4f41-824d-83d493da25c6", "comment": "Malware payload (Smoke Loader)", "value": "ee568949e4282f43dbdad7fe207618e524c6eaf8bd29a575b6c6e8afdbdc22130d9a811c282e54464532bc9dcaf02daf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814721, "uuid": "099c2af1-51c0-4ce0-b12b-9613c0f89598", "value": "T1F414D0313690C2F2C47B14307864DBA42FBEB53996B5895B77A40BBE4F3C2D1563A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814721, "uuid": "8eedeea2-28a8-4522-af61-273778007c9a", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814721, "uuid": "5ca5abfb-b3be-4a47-81ca-86e0b4a7118d", "value": "3072:Ff8OwwHIEWFNALm4wNWoa5FCN/+TpWlvi5qUG33bJJ8YZvpn:Ff8lnaLmTN6CN/+T4MIUS3/Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675814721, "uuid": "3df2fb3a-9bc0-4775-aaff-b9e093a49ebc", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675814721, "uuid": "19c39183-e5c3-4d82-8278-96a607f45178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814721, "uuid": "b44da9fa-def1-4ca5-8bd1-dfdc0d010d42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2981698-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Arechclient2)", "timestamp": 1675883271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883271, "uuid": "03fe7407-18d8-46a2-9b46-cb47e2c9049c", "comment": "Malware payload (Arechclient2)", "value": "5b24595c1d71380b7a907c119c374e67", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883271, "uuid": "6fa863dc-a636-401a-b160-870976d24cc4", "comment": "Malware payload (Arechclient2)", "value": "74fa53e41a11303fa8217b66da05787146f5416fe9b9b121814af6e3efc9653e", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883271, "uuid": "b3043cf1-cfe5-4051-a206-ca94b535a968", "comment": "Malware payload (Arechclient2)", "value": "6da0f54309ac68e2a61481fa626427ca1da885b0", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883271, "uuid": "ab60b02d-a531-4cf8-be08-73223a4612da", "comment": "Malware payload (Arechclient2)", "value": "a73565046576fbd5a6d25e6cc90e75d5b0ffd402b489704ed2bdc528da897140e2366ac1ad7be4d532408da52560a739", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883271, "uuid": "e68735b9-d94d-490f-9454-cd62de96a567", "value": "T1C446237AD1220049F4ED8C378923FEACB1F52A17AB51AC3D3DB676D06273594F106A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883271, "uuid": "39cec3f6-1e13-4283-9f9f-ed031d0c49dc", "value": "c7c88a9f12777d4c1f156ccc8f276fa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883271, "uuid": "616da6dc-e26b-4eb6-9087-bd1ae941e1fd", "value": "98304:1PlqSMM8UgZhYQ1E3kM5Y9BazgOJErCCOWdwl1LI/FoSLgX8m3w5+Zs4t:wZ11JM5YHaVGrCc/FFLgMzIZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883271, "uuid": "458dfeb6-3832-4670-9391-9e0a7ed1b1c0", "value": 5746176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883271, "uuid": "8599a8db-6014-495c-b3f2-c2885f845a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883271, "uuid": "5270a2ce-fe2a-4411-a231-e8fc71bc49c1", "value": "5b24595c1d71380b7a907c119c374e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5160f41-a80a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675900026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900026, "uuid": "b21e747f-a9ec-4f3c-9a45-aa35243b79b6", "comment": "Malware payload", "value": "efdc728bad04430a456328b5d9e7a493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900026, "uuid": "01f81109-3ee2-4cf8-b18d-a70bfc4332da", "comment": "Malware payload", "value": "75048617d624274b2e48c9571fbdfbd92c32227531d211a2fb116905d0403f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900026, "uuid": "505326c1-4230-4bd8-9915-e3165a6ad2b3", "comment": "Malware payload", "value": "e5ece09269d2677dfa11df8da939f7242245e043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900026, "uuid": "59bf06bb-9d8b-4afa-91d8-ab8b83c68de3", "comment": "Malware payload", "value": "12b97bcd10cd5c495afdc654b315c2fd64c08dbe1f9dd8532c0fa6c1cada9a3c86384e87fc8523f84ea42b0505c618d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900026, "uuid": "47f79391-4451-4c98-afda-186d1638168c", "value": "T1FAC40207F7EC9072E9B457B01CF203D30535BEA16A34929B635FAC9A18727A4613237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900026, "uuid": "c086a93e-5578-4059-90a6-a2af175c6689", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900026, "uuid": "e61fb23b-2342-4cef-8f33-5eec6eacf958", "value": "12288:oMrCy90R8dpE/i2xRism9MuXSF4W3pyTIn1A0VD3ex:qyw4pE/i8RtayDj20VDux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900026, "uuid": "7cf47c94-33a8-4dd2-a928-0d6b9d944890", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900026, "uuid": "7259b779-83ca-44bc-aab3-cc59253ee5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900026, "uuid": "d3989015-da14-42cd-92b2-1d266ae12d95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093f8055-a7f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675889349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889349, "uuid": "9b812deb-a5d4-4291-aca7-21e881ab6ac6", "comment": "Malware payload", "value": "c170fcc0a3b452aaa9d330840112be89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889349, "uuid": "2a8e6cdd-7e78-45ff-9377-db1256c3b1cc", "comment": "Malware payload", "value": "75861f31332d6ac42867c5e1d9be02f34ce919aaae58d592d8c5f32b33e128af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889349, "uuid": "15ea0cd5-25a1-435c-b827-0dca9ee9dd08", "comment": "Malware payload", "value": "a3f2bf0fbc7b431f843ef4d24fbcf1d79e3b031e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889349, "uuid": "f3fe39f7-9b80-4caf-b070-fd54c368def1", "comment": "Malware payload", "value": "13357ecc931aaa241795dda60a350d27c943dfbe820564b71e7d0540ee89c42847565fee1f4b2ebaa17c07e6a4ad1943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889349, "uuid": "a1a6ebd9-e63e-4dbe-ab25-9cb7cd6d9493", "value": "T1B5C40217E7EC9022E8B417B118F607D71B32BDA42F39C75A124E6D160DB36A4B63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889349, "uuid": "c54c373e-7d91-44d0-8a67-84e256b996d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889349, "uuid": "231f90cc-6a27-414b-a857-83b7bc3b0984", "value": "12288:TMrTy90VtBGzbBIgiuMUnMBkWOFr/+zBQ4eIotsAGU:sycEenuM3L+r/SbKcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675889349, "uuid": "ed6084ce-1a45-49a7-af0c-faf820064218", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675889349, "uuid": "82cf234c-ac78-48c8-a52d-6a257b6a8634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889349, "uuid": "ffbd1114-fa40-450f-a702-9c3c2e5733d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72388f3-a794-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675849349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849349, "uuid": "3e2515a4-3dd2-46b7-befd-c7efd80e6706", "comment": "Malware payload (AgentTesla)", "value": "353f418298c477e7a0a72929aac5e54b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849349, "uuid": "56f2cfa6-afa2-4266-924b-ea3ea77d3b78", "comment": "Malware payload (AgentTesla)", "value": "760928fb6ade23fb3bf0d5c531bbd44c95cf39d13095374b67702014b27f927d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849349, "uuid": "5835c779-13e6-491f-9e4e-264224bbe3fc", "comment": "Malware payload (AgentTesla)", "value": "5b0c28946ae87d8b7889ccae2586dada2362b6cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849349, "uuid": "45d8b529-3c8c-40f5-b8df-51c2c895305a", "comment": "Malware payload (AgentTesla)", "value": "ebe7f5714b80ad7d442e771631464ce124ee69fe118d3f3ef6b49de68881df481e2536b167db251fedc7f723311abe25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849349, "uuid": "ac6c2b5b-c76a-4a4b-a46c-bb2e3460f2ef", "value": "T1E7B423A6888D415CE6EEE3E1636F4123B0E09F8CEC5ED5443D42A6811893679F71DB3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849349, "uuid": "d658baa4-04c5-4bd1-9a01-8421eebf1eda", "value": "12288:OdUH+zPhECfE8uSfvwsCv2BkdexUbGptPALFxKrvFY9K8:Oi015uSnan4SGQFxUFY9K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675849349, "uuid": "3ba140cb-56b7-438c-9d52-ab4b0d910002", "value": 502754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675849349, "uuid": "0ec196d1-b9a7-423f-a6a1-a9248c2bc355", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849349, "uuid": "b94e7179-5b97-4097-a079-732d7558a6ab", "value": "New Shipment.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f1bf86-a7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675872565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872565, "uuid": "41b0e46b-eefc-4886-ad44-be80c20ef2d9", "comment": "Malware payload (Amadey)", "value": "abba910d01ba9087f846fbbf58c6c420", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872565, "uuid": "4b3651a3-66a3-4123-9d1e-6156b6f586ac", "comment": "Malware payload (Amadey)", "value": "762be5e34ac0478584e6eda1ceb867cef0fa9fb7b41b55243331c24e51f9e57d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872565, "uuid": "356768a9-9cbf-44fb-aa69-0997c2ec3d1c", "comment": "Malware payload (Amadey)", "value": "e7f65272edbcaf76dfdf0586c64084d1764707a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872565, "uuid": "13d886ba-4dab-4bcc-ad5b-3798d209d95e", "comment": "Malware payload (Amadey)", "value": "3865d1e416999305cd8d83740bf4fd6a728dfa1ddb530d589bac4f2e65c49ac1264f931d614ea220f00315d186a9dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872565, "uuid": "aa69cb25-5439-4d41-b436-2db1528bf885", "value": "T1F1C40207B6EC8032D8B6577025FA03C306367D509A79979E239B6C5A18B36B175323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872565, "uuid": "e2d12d4b-25a5-4a5c-ae6f-4632cdb7d01d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872565, "uuid": "819a58ec-7f98-4232-82d2-e896a2b70bfa", "value": "12288:AMr6y90M4XsYvwshGhflBkYS4BM/+KwjzKNNm9XtQZIejN6cKX:qyL48YRhGhfl6Z4BM/hTjG9Q2eTKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872565, "uuid": "ae6f89ab-250e-41c6-a361-983921cc4441", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872565, "uuid": "30914ea6-12d6-42c4-8548-f004b3c55c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872565, "uuid": "3fe856f0-15d7-4b34-b0e7-63daed8532af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cb62e0-a7be-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675867323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867323, "uuid": "91a1afe4-aa0a-4a90-b3b0-7badbae44a85", "comment": "Malware payload (SnakeKeylogger)", "value": "46652b412099ff8ac04dea36bd794e13", "object_relation": "md5", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867323, "uuid": "714ceeb8-4f2e-4ac2-a3c9-107a2b87e825", "comment": "Malware payload (SnakeKeylogger)", "value": "763fda12475dbc5e8fdeb9aeb0972a47e36e1fcce179762b5898c1ef5199a919", "object_relation": "sha256", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867323, "uuid": "6528680a-9ff9-4bec-9b3a-ccfd7449938e", "comment": "Malware payload (SnakeKeylogger)", "value": "30a904c956f8e715572d1122c5919c18f3a1621c", "object_relation": "sha1", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867323, "uuid": "a37c0744-f6fa-4e30-bbea-c3aff5f87d15", "comment": "Malware payload (SnakeKeylogger)", "value": "cc3d2c1a8601453add707bda0847a370c088a39bbba2215a2a662e15588f9c26f15cadf93b6926bfa06c5a37e34f42b5", "object_relation": "sha3-384", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867323, "uuid": "d15d140a-8236-43ba-ba7c-378ca38b2492", "value": "T14252DF847BE5A21C9E71C996764D403F8B2E7236BF672CAC85E5016F980D02FD9C893C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867323, "uuid": "bcdccb24-41ec-4b85-ace8-9bb18b7c4936", "value": "384:JBeZy8AI125FuJRixl44wFm2mpbkT9Txqad:JBeZy8SUtmFAxqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867323, "uuid": "2b827672-b050-44f4-bfa2-3ac1db4211c7", "value": 14225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867323, "uuid": "4183b83b-6b51-4e81-8fa5-6b812813f4fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867323, "uuid": "333cc68a-ea72-48c8-9a28-8cc9c4b139f7", "value": "Purchase order.pdf.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6de8ec-a76b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675831480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831480, "uuid": "089e6a6a-bcc9-4bc5-bb5c-6998e9d7cf2d", "comment": "Malware payload (Amadey)", "value": "5031ff5c86afe19e021698dad2daf863", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831480, "uuid": "efc3ef6a-7d96-4683-94dc-d0ee628285f7", "comment": "Malware payload (Amadey)", "value": "768bb0daffa49635156a7f9212e0269feff34d32caeaa04e6a73964736fde70c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831480, "uuid": "2a85b247-a73c-46b0-8b53-be59349af26e", "comment": "Malware payload (Amadey)", "value": "192f91f61f32de34df2846adc5b0fbb1301d8753", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831480, "uuid": "897ae60a-0405-4001-8e7c-4e84f865c1da", "comment": "Malware payload (Amadey)", "value": "3fd733ab02227832193eab8fb5ddd3af64c735d1d5b8168c7360797b894e5e3ed275988beb18f273da7d8b5fc5510538", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831480, "uuid": "ce2ca400-b706-4369-81ba-4ae6a38ea160", "value": "T115B40247E7EC5032E9B5177018F702C30A36BD626A7883A6278F5C5F19726B0A631777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831480, "uuid": "47ba33cd-14bc-499e-8e38-0e3814694bcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831480, "uuid": "3f03e48b-6466-4efb-bc5d-c4b94ae85d72", "value": "12288:6MrDy909y14qg/68i9r14f9S1u5Xz4d/OetYc:lyXNg/68uU9S1tGetn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675831480, "uuid": "c3d4ba26-9e7d-43e1-992b-86ca13693fd5", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675831480, "uuid": "7c3a4db8-db3d-4e43-b7dc-680e3823333c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831480, "uuid": "b6240270-138a-4668-ba0f-c512a6a58ba6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a476a086-a7e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675884456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884456, "uuid": "7238cd27-0430-4a61-96f0-a9fee98e62c0", "comment": "Malware payload (Loki)", "value": "f39a3b0c3ab67647abb51458a6a8608c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884456, "uuid": "a36729f8-010b-4afc-a069-5b2247a38d13", "comment": "Malware payload (Loki)", "value": "76ae0354e5a2b078e21537bd939314116d7904b820af132c877c72354fccea9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884456, "uuid": "0e4452ac-7b79-49f5-a76b-043d2933ea57", "comment": "Malware payload (Loki)", "value": "cc6e1f8bfbac625ebc05437e4010c3f3596d7eb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884456, "uuid": "11f03598-1aff-4abb-9e55-776378a5eb01", "comment": "Malware payload (Loki)", "value": "9bd999ebfb7b58ca178237c8c4fabfa8bb6527f4ed689af042e2c2a472e1f7c83c645a4b9226b9f0719026f6ab9b56c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884456, "uuid": "6ecd36b9-32f6-4e7b-829c-53adde4ba0cf", "value": "T1A705DF116394CE06E4B543B84AB2EBE013737876D1A5EED8ADC26CCE0625F6178437DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884456, "uuid": "a658e275-a3d5-4dc6-8156-cc62324fdef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884456, "uuid": "faa701b8-b5d7-4384-abc6-6c7cbb57cfcc", "value": "12288:KiWlV/Dfrps1P4M/Qe0iIhBZfZywqRaIwFkLIZwzAbWlV/:QlpDTpQwMYefRyFI/kqlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675884456, "uuid": "624d09e3-6df4-4293-b107-6a45ae2526ed", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675884456, "uuid": "f6d04d36-7e17-44f0-8627-af484797eb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884456, "uuid": "7d634eab-c06a-48a0-a6bf-b11f40b9acb3", "value": "f39a3b0c3ab67647abb51458a6a8608c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d2116d-a7ed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675887241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887241, "uuid": "5964edc2-7f33-4e6a-92cb-dee6b9fed25d", "comment": "Malware payload", "value": "ee6ef404c8821e2e84f4a984769ea62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887241, "uuid": "696dd61c-dce9-4fa8-8e4b-b33f60d1bf65", "comment": "Malware payload", "value": "76bdfb42ed618b1867d78736e3436c71c530c571808ac89bfa715a0172bfc8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887241, "uuid": "b4fe232d-3a1d-4457-8af2-b9dee452d208", "comment": "Malware payload", "value": "e9c3b9a797c8718297c31a57898b3fb55c5ffd3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887241, "uuid": "8eceecea-2392-459b-b791-83ae79a6269c", "comment": "Malware payload", "value": "8ebb39df95d253b2467155deb6d26b48275ac94f146103fb7f0a2bb2d129acf9bedd5dbfaa537e819d3fb58d431e8f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887241, "uuid": "6b14cfc7-b56c-4c67-8501-fe54d32393a3", "value": "T1AFC40247F6E94022E8F057701CF70BC71637BEA62F348357178AAE5619726A4B23172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887241, "uuid": "5f9b2e6a-f779-47b0-b729-f2efeb85f7fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887241, "uuid": "9e109727-68f2-444f-8812-f5ba6be8fb7c", "value": "12288:KMr9y90ahB514dgaYVB/MakWO2r/+RV/4TqqB:3yH+WVBjLtr/wWTvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675887241, "uuid": "44267d52-fca5-4bd4-b68b-1c8dda67f850", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675887241, "uuid": "52c775de-1013-461b-9e0b-d08e24fcbac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887241, "uuid": "702513b8-0d50-4a00-97a7-c9e96c9b7241", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1624b8b-a753-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675821395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821395, "uuid": "15aee9b3-b844-41b2-83e0-d68907a01ddf", "comment": "Malware payload (Amadey)", "value": "13b35872e92ffbf7149d2a7c94f4e8d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821395, "uuid": "5e1e820b-6bb1-48d8-9003-a993459f8a28", "comment": "Malware payload (Amadey)", "value": "76e679e62173928fc18dba93fd25db0fdf6a2fa378cf749ce5d954fd7ca16e98", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821395, "uuid": "540a7763-6b94-4564-b430-ba6b6051058d", "comment": "Malware payload (Amadey)", "value": "9523128f0257a4a153dd99f0b8dae49766dfef63", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821395, "uuid": "fe26db2e-718b-4b90-8099-a61c5f51092f", "comment": "Malware payload (Amadey)", "value": "84f946f8e8fed72fe858877403cb3ee1054046d7f3647cd9c34a022e33746595ceacd51557477104f440e75ca88aefeb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821395, "uuid": "9f70ed5b-9bb1-44e2-9c67-4a3da7bad846", "value": "T1BFB40247BBFC8036E9B657B009F703D30A36BD609A34836B334B6D991C725A46636367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821395, "uuid": "c1eed212-0ab4-4a02-a092-0e3c229fed4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821395, "uuid": "c3dd003b-1953-4c97-af99-9e740ead0222", "value": "6144:K4y+bnr+Gp0yN90QEZmhgNVdItkr4DgC/qGDkfz5EcduDB/d2N+q7CCrZfHcNNMr:0MrGy90pNVQs41yGDgaAPCScEdI5Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675821395, "uuid": "160abad5-6b14-4b80-913f-d7c59f28ee91", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675821395, "uuid": "a0eb6179-9293-4cfb-b63c-63965bb33d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821395, "uuid": "f74bd197-c7d6-40dd-82b8-852b2d713277", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a1236-a77a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675838088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838088, "uuid": "cd1eea7e-023a-42d6-813b-9c4aa92cc923", "comment": "Malware payload (Smoke Loader)", "value": "b23e0893cc70c681ef83552661f5d907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838088, "uuid": "efe74bdb-4888-4cdc-99ce-a65572d5ddb7", "comment": "Malware payload (Smoke Loader)", "value": "76ee36fc77ce8a0a8650634a066329219c795aaa0dd2d2762851c9652a24833c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838088, "uuid": "be42d736-baf4-4352-933f-68d88ddacdac", "comment": "Malware payload (Smoke Loader)", "value": "c6781f236f69a7225c7a932d42293e640cd79aa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838088, "uuid": "8b24a6e6-88d6-425f-a427-3dafc84e6134", "comment": "Malware payload (Smoke Loader)", "value": "c76e1f0aab267f695956f9d7071d7d658d4d0a9785065e60f63ad31b2c4702ecbfcd7d9243d06c953ccea600ea9b3e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838088, "uuid": "39b33e50-2bc0-411f-b2cd-b7038e18c01c", "value": "T130644A53A3E17C88EA25CB73DE1EC6E8F65DF590EE4A37693218AA1F1C70072C563611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838088, "uuid": "3fd1391d-16a4-4c59-924e-07cb81d509c3", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838088, "uuid": "df2bae29-df81-4faa-aa23-8b42e20d8aec", "value": "6144:049DUcpc+C+C8akMfTwpkfrWUj542YIu:0SD/j5C8akqTwKTxd+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838088, "uuid": "08e23fb4-81e1-459f-a4c7-7f001acc4af3", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838088, "uuid": "a6b0f058-c140-467f-9de2-58ef757d0601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838088, "uuid": "ec34baea-ac72-4d2e-9eea-7e5323877629", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b451e4-a7f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890692, "uuid": "cc0bc272-dfdd-4bff-b9f2-a51b2a28c14b", "comment": "Malware payload", "value": "2a3046dc376b0dbfb41809cbcb22250b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890692, "uuid": "7f80ca57-7dd8-4df4-97af-f0d471d68499", "comment": "Malware payload", "value": "76fdcec8931c771caa895e4faa4fa01326ea9a96d07ad3e496fb91881b2c97ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890692, "uuid": "613e653e-3b87-4ee5-a3b3-993b5d712056", "comment": "Malware payload", "value": "077795bd411c78571b2b2bbea711565f2eaf89ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890692, "uuid": "5af73935-9043-42b3-97df-8b86ae5957ef", "comment": "Malware payload", "value": "07e0889ee259c8f792ba7c731ba6a42a83168bc064089dcfba4501ac82074050cc646273238ad5d98ca7c87b9b83bf03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890692, "uuid": "4ba6fbe6-563f-44a3-be75-d171a87105bb", "value": "T10DC41207E2EC8062E8B557B01DF707D31632BE605A38939B678F6C4E0DB3560A636767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890692, "uuid": "b36ff970-8e19-4edd-ade1-52fb61106233", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890692, "uuid": "b7380e45-f04b-431f-9114-391a4d394585", "value": "12288:PMr0y90qXwa56reTOGayPCBy2fft22rFSr0igZ8PBPI6rbXGScR:ryLt4eaTsEdft2DBPn2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890692, "uuid": "632ec544-2864-4b5a-8075-f264471eeea0", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890692, "uuid": "8bf65730-862a-41ff-b383-4ca003c10836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890692, "uuid": "cdeb7ce7-0a3d-4cd1-bebb-8146c37aa63e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0e9a79-a7d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675876229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876229, "uuid": "787b6947-955e-4079-8eda-1503ef918e81", "comment": "Malware payload (Loki)", "value": "09ba55133ed0927f4be9bc3a4a160138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876229, "uuid": "ed273547-382c-4ba8-8080-29e766c3f50b", "comment": "Malware payload (Loki)", "value": "7703fbd49c40156691183e9c3cb21b6efa5789e06cbd4666747ce1a2ab8b8dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876229, "uuid": "fee6d95e-e2e7-4e77-8ab5-d581318003cf", "comment": "Malware payload (Loki)", "value": "ef6c835bc7f67da39636feda71cba227757e3261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876229, "uuid": "2103bef6-ed36-4e46-9b81-7327355b2627", "comment": "Malware payload (Loki)", "value": "89839b47589ddbb08cd710bc0ea7ec40f7b2d6f0f2534bc9cdb08839fac837d2a04bafa147943cd3dd967707afefb371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876229, "uuid": "10a5e22c-5631-4e6c-b36b-fdd31431d65a", "value": "T15A14CF323AA0C072C66728345D2CE7E53B7EB43156B98C5B7B681B6D4F306D16A3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876229, "uuid": "b270c9ae-828d-4f70-9b63-5607c5ec4a75", "value": "d8ad863864e459165b4fe2dc00d190c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876229, "uuid": "ecafea87-11e9-410f-8af5-7f0623c74213", "value": "3072:vPPbOF1ZcnfkuQL5RIWUC95Brw29OaSg8c8TIb6yAEmhAmWcDvW:3PbiCfiL3IUw29qg8RUb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876229, "uuid": "23d9202f-01e4-4dbe-90f3-c053c539aa96", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876229, "uuid": "fc8f32c8-cb46-41c6-af7e-48ae459fff47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876229, "uuid": "3f6f345b-c570-4f8d-8893-028a8853d051", "value": "09ba55133ed0927f4be9bc3a4a160138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e817e4-a780-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675840656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840656, "uuid": "0c819e96-523b-4fbf-a317-cb2dbe7fcf33", "comment": "Malware payload (GCleaner)", "value": "2cc602b3d352756b26fc2675b5dcddfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840656, "uuid": "1e709c9f-8c31-46d1-9c66-8f9135bf1903", "comment": "Malware payload (GCleaner)", "value": "773c67df650da69a2aad95db2e4e01726fea03d8b8fbba230b8c753aae7b6cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840656, "uuid": "e0df9d49-fb9d-4009-baf9-43a474b70ae8", "comment": "Malware payload (GCleaner)", "value": "1b1e792e65955199fd80612696475474abad9934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675840656, "uuid": "df4e0cc7-8205-4031-a20f-179bb285176f", "comment": "Malware payload (GCleaner)", "value": "66ecfc1ad5346d781f9961c771346c8f58881446a56888414c23a93391c66df80888f740006f7b8537649fba213c96e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840656, "uuid": "800bb045-83f5-4f50-952b-35aa5d50ee94", "value": "T1BBC5127CB545C4ADC290BEB08D3AD8E71CD72EE3D9E4906270D97F3F52B92849A0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840656, "uuid": "810a61d0-c1e2-482f-a66c-0107f5324bfa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840656, "uuid": "ed33a7f1-8f03-48b8-8fbc-13aea8561925", "value": "49152:rdHe6PDOKTFhJnbdugWc/pMbULmdScQGCqUgYLJ0E0hqLCgv2MR:JHe6PaKTbJZz/pMbULESc7Cq1YyXCv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675840656, "uuid": "23466d4d-017a-4ac5-958f-344f1b9abfb2", "value": 2729410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675840656, "uuid": "f9672507-9d8d-45c6-bceb-04f96e7b9878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675840656, "uuid": "5ce28b06-f27c-45a6-a4e1-53148a3834a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b6a61e-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885498, "uuid": "6151a116-0981-4864-ab5f-6a7dd929adbb", "comment": "Malware payload", "value": "612d3f556d9dd220118291598c0c42fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885498, "uuid": "23416852-4d30-4822-b615-b4c8f06afe00", "comment": "Malware payload", "value": "77570db1195a42024717d6223e0c55bc77e0246080b2fa7de24eac97391cdeda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885498, "uuid": "f1aeac77-ed4a-49b8-afde-072f16204778", "comment": "Malware payload", "value": "d3dece847f5c4030a2b22814969aab6417642782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885498, "uuid": "4aa376f1-02bf-420b-91f1-4ae982fcab4a", "comment": "Malware payload", "value": "036b32ca98b50d6fb92cb1fb9979c2313943c3d4d97e91614acf07f3b6f411811e5c6231bc37b48428a7296042802187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885498, "uuid": "f8f41a59-99f3-49cd-918c-f3565048f336", "value": "T105643903D3D27C81F9668B769E1FF7E8765DF5A28E4AB7653218EA2F10B0076C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885498, "uuid": "5d48b8c0-bdb7-4b85-af24-7dd4462ea07a", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885498, "uuid": "49241546-5495-4380-9150-7e0cd1754202", "value": "3072:DPg5dVrNzxR9+r+sRwu9e1hBvXVMwkfhe3g2GmesWQDiuLpNoAE+gvJ:D+dL5+KXuihBvXVMBhZALLiq6z7vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885498, "uuid": "e4caa617-0eb0-4ed5-a744-968c66083c87", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885498, "uuid": "cf846dd3-e077-4459-9482-4c8b7bd329da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885498, "uuid": "f57bbe8c-ed76-4ce7-b92c-de4c058a0b58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87903ab-a75f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675826507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826507, "uuid": "33ee6773-d44d-4e66-a8cd-f692f607772c", "comment": "Malware payload (Amadey)", "value": "f6e161180871dc40614423a0e9c7c63b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826507, "uuid": "3e065729-fb2d-455b-843f-86218e9504b4", "comment": "Malware payload (Amadey)", "value": "7784577b6dd855b5a7eb0695d8f400d8a21f92cb26b9a16bea1a8c0a0826632b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826507, "uuid": "6de1d09b-a4e7-42a7-9aec-c3834449cbd5", "comment": "Malware payload (Amadey)", "value": "d4dc02375ff83614835dedf3bd3418f9b6c1a565", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675826507, "uuid": "588776e0-750e-4404-8584-80d0098953ac", "comment": "Malware payload (Amadey)", "value": "acb99741cdf642f04dc6bc7d23f43dbc59a80dce4d2cdf534cc998b5579fde57aee7d7ae17a5c10744ed180a19809133", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826507, "uuid": "c4e49261-025f-4d97-a23a-9d3945040386", "value": "T1FCB40207A7E89132D875177009F702D3163BBEA19678A39B234EAD5918732B4F13673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826507, "uuid": "3877b0e2-3d8f-47c7-a1fe-a8fa1fbfe5cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826507, "uuid": "4ac9656a-9002-4318-a191-86430d8f51c0", "value": "12288:yMrCy90ISfDxL+23wr3xE64mYfnBhg+KmunXcD:My1SfDNHkx34m4hg+EnXcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675826507, "uuid": "734bb6a7-56a5-4800-967b-79cb621541bc", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675826507, "uuid": "09c29a06-2ecb-491d-b7dd-00e8b51efca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675826507, "uuid": "e5d8959d-1ee5-4e0e-be60-c6a56a1f8f94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17eb7b4-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885310, "uuid": "fdd12267-3bc3-4083-9d92-ee95d463c211", "comment": "Malware payload (Mirai)", "value": "6b30194f8fd64411d8d95b690fb6e207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885310, "uuid": "124489ae-72ae-494d-9e2b-27848dd116a8", "comment": "Malware payload (Mirai)", "value": "782f844313d859e7cf571f4dcd150a756cd04964cd1d0c0a56eaa67f14f7c6d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885310, "uuid": "25a5aac7-8f0c-43ec-a4fc-a4b8c8705bad", "comment": "Malware payload (Mirai)", "value": "5fdccf5b9eedb5bf0c020e3efee6c8e382cadd13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885310, "uuid": "f2e5ca0c-b363-412b-ab31-c0837c80eac2", "comment": "Malware payload (Mirai)", "value": "3f632653a1e58079f0d9a87fc79c5eb5f1415abeaaffd7a34ee5ea86f097a6942a96bbf5c69c544f6d201aad74a1cd2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885310, "uuid": "5d5257f6-c086-409c-9e99-31fe28a5009e", "value": "T199332881BC919A13CAC423B6FA2E01CD372563A9E2DF3207DE216F1177CA92F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885310, "uuid": "92cda35a-e74e-40b7-b751-048717a8ec4b", "value": "768:qwQhosc6moXSWmfZ9hcQrhpnwexESfq7ZAoOeXKYBNOS9J1y+vM6:yhosc6QWCZ9hcQVB2SS7Z1b9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885310, "uuid": "79a32c11-fe2e-4b23-a078-9123e0428e66", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885310, "uuid": "814490dd-8e96-4548-97b0-5fe69b233c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885310, "uuid": "968f46be-5ccf-495a-a964-96a303cea663", "value": "6b30194f8fd64411d8d95b690fb6e207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a8edf3-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885640, "uuid": "bec5c505-43a9-4d8e-889b-22e43dba8518", "comment": "Malware payload", "value": "4c0a356b5aa5d7ec998d53e3ce131c76", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885640, "uuid": "883e9d3a-4267-4077-9a5c-1522113d7b1d", "comment": "Malware payload", "value": "7838ce97a9401406f1145c1ff3b0715df8da2c0584c21ce29582a80e34589f17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885640, "uuid": "411dfbb8-2ac9-4d31-837a-2238855b9e7a", "comment": "Malware payload", "value": "7a7bb3f6de5f2c293a4aa72c153ff90b3f06e210", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885640, "uuid": "c29052f7-c31f-4eb1-b850-9d2fcfd641b7", "comment": "Malware payload", "value": "8a49024331e41fa7b0f1aa5a9dd3cbe0c51d580848e741d64d104c5a3e66b8b1300c92dfeb7d777c334b0a9b0f967f8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885640, "uuid": "05e7ba50-c086-4432-b12c-c570123aa554", "value": "T1E1A5831C9683C5FEFA634BEFE3DCBA528175AE03FA8E4C0245EC74151D95C8A612C897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885640, "uuid": "1cad52e6-bed5-4544-8ef8-dcde641f1eda", "value": "192:4a2AmAiAKADAEA8AYAQAUaubxhqjmpUV1f28aR2bfLYC9QFmRUyxGqEAKz5rUqel:MXvT6hxF1qPk7uF7vRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885640, "uuid": "2d4d2d4e-a1c0-4180-a861-784b8c5de9f2", "value": 2253431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885640, "uuid": "1e61c709-934b-4e64-8ee4-c47264f07539", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885640, "uuid": "feeeb0d7-36bf-4bad-b9a2-68298560fd00", "value": "Original_shipping_documents_pdf.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e85c12-a7aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675858817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858817, "uuid": "adbf0c5a-69c7-48a6-92d3-3496a86ad1d7", "comment": "Malware payload (AgentTesla)", "value": "0e4714d699218c642944629a8cc61080", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858817, "uuid": "2e6d9047-d6db-4569-b40d-ed41d3dda43a", "comment": "Malware payload (AgentTesla)", "value": "784b7add943c1ca56c306ba83f5141e6133195e6678a05a1f3ffedc14e1ea452", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858817, "uuid": "e9eab6bd-1d06-4d28-b3d9-35f73f022d56", "comment": "Malware payload (AgentTesla)", "value": "6314f7f0a6d05fd01b48971b711d925aa64bd94a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858817, "uuid": "fadf1d85-1e28-48a5-80ac-aed11aac04de", "comment": "Malware payload (AgentTesla)", "value": "52c88fb2a9db5eff38673d27ad25add9bc5bf4f5ec6ba3ae658b6f53191b89c1abfd2a760e88b13a1c5b97bd2ea4274c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858817, "uuid": "d09ad7f5-4e23-4ff8-ae22-39d0b5986ef7", "value": "T1C7B42386C0F26F0E1F57A722859C71BE7B44A7E46B3B11DE858D49C49FF141490DCAA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858817, "uuid": "96e347d8-32b6-4574-81ea-983458069ce7", "value": "12288:tETynozfWJnmlu7Vt1V5ZGWrAAmHmjJ8P/pEV:tXoLqmlURZn1mGuxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858817, "uuid": "44578e28-b2ae-496c-abb0-f70c54f08518", "value": 523726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858817, "uuid": "bb4b696f-462f-4d9d-aa57-080aa6da764e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858817, "uuid": "d6b6fcb4-1d4c-4eb3-89e0-fa0769752988", "value": "BL 203948 34 xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c57f874-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675881301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881301, "uuid": "625c7385-1be9-48a7-96e8-1d3afb5e3c89", "comment": "Malware payload (Amadey)", "value": "a79b78169ef7c5888cff33abee19312a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881301, "uuid": "53887167-d200-4652-9414-ebeb5c3a6571", "comment": "Malware payload (Amadey)", "value": "784f8214e3d795ccddcf6bef9ed61eaa992137fe41c80db781aae66579c32a2e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881301, "uuid": "10b54e1f-d20f-43bf-8bd4-dda13f6e15e9", "comment": "Malware payload (Amadey)", "value": "ed6ad2a8ff793fbdee8e8ca66574a49216026498", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881301, "uuid": "1db84f7e-ee57-4c9c-9eb0-ebcc1d2f94d4", "comment": "Malware payload (Amadey)", "value": "c21518c24acf4407e755e2b97d1484f02b4bc29c64aac85f4d599976bec8c46d2dfd71fcbd47a1473f356fa853b58119", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881301, "uuid": "8200808a-d5f9-455d-8d5e-de18c78e2dd2", "value": "T141B40247B7F88036E8B417B019F602D30B32BD715A34825B278EAD1A1DB2371B67576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881301, "uuid": "21b6a298-8ae6-4d40-b088-2daf7df6e5b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881301, "uuid": "108f9eab-d6ae-45b7-a79f-e313c1dd618d", "value": "12288:SMrQy903h+IY1cXoqTjHwjqSic8uqLBkWsaYC6P:eyov+dS1n6PaYbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881301, "uuid": "bcf8263d-72ea-4169-95e1-d235a3bec68d", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881301, "uuid": "60818182-07fe-4ec6-814e-53f048250043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881301, "uuid": "7d6cd50d-c707-4c92-a7f9-12c30246bbb5", "value": "a79b78169ef7c5888cff33abee19312a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16398c81-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675880781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880781, "uuid": "cc5fb815-9663-4261-9d6c-446829d3edc5", "comment": "Malware payload (SystemBC)", "value": "0c9406ae7b6215874ab0694dc795da3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880781, "uuid": "93fde296-79b8-4681-bb6b-d9dca6d773f9", "comment": "Malware payload (SystemBC)", "value": "788477c79faa2ed3b28f7232f1114b94d513dd643f4d0bcc0441d77a1eab4058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880781, "uuid": "2ad98c30-aab6-4af8-a3c6-38aede94f231", "comment": "Malware payload (SystemBC)", "value": "733939cb4a05bec0d2017024f6256e05d17cf904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880781, "uuid": "55356f07-f2ad-4888-8a08-ba3168cc4410", "comment": "Malware payload (SystemBC)", "value": "397e1e0047c2be35d08cbccc5b5a2b6279a7b1125548d3b90c7159af23bd1a9d9bec65d7dc8894058f025a63e3e675e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880781, "uuid": "35054b69-1609-411c-8acf-42b1625be3b6", "value": "T1BA86238D058A51F4D5CC1234912BFEDB33F25EAA4D918C2EBEC5788E6572F66E036483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880781, "uuid": "43c8bd1f-68e1-47f8-80d5-6a7a32e8db85", "value": "24d29255658d65fd08ba9d0a6637209b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880781, "uuid": "a2f5e310-2f9f-4dc7-88f5-a9c7f8f045cc", "value": "196608:ACvO+CId6GWCQS15dK+OvSqYYz3Kf4PalECQZHpzRkNLMDkDY:V6i/O6qPG3lfSHuns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880781, "uuid": "542b3f39-b79a-4039-8f64-f7af7ab4762f", "value": 7847424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880781, "uuid": "e7c97371-0843-480f-99a9-c0cd53413a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880781, "uuid": "ad038c83-8c35-402a-8899-47f9ef4e80fc", "value": "0c9406ae7b6215874ab0694dc795da3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a7796c-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675859007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859007, "uuid": "265061b8-c576-4959-a572-ee7cd15373b0", "comment": "Malware payload (Mirai)", "value": "ee99121a939d76031fc1232189687885", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859007, "uuid": "2c6d27dd-8660-41c1-84a1-e10a19ae1fa1", "comment": "Malware payload (Mirai)", "value": "78969c4e7d304235a4bf79c6a12edff42d9841a970dd34f69e2158c665ead5ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859007, "uuid": "c4d333ea-8f36-42d7-9d6f-2b04ec7fc35b", "comment": "Malware payload (Mirai)", "value": "279c81ba67ef80ae235d34ce82e82bee85329cad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859007, "uuid": "fedc9560-9be9-47e2-b926-352786705dff", "comment": "Malware payload (Mirai)", "value": "19a643f282658280ca4ed381649d0cd2a3b10fba91872a587d9f33bf80c6ab3b7c758f1a8ea1425d0af045e891b12187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859007, "uuid": "a5bc8883-d56e-48ab-a986-5a2cac2ecc7f", "value": "T17DC2D0B912C63862D6707278EB9EC532166B473982FE30B901F903B25AC534D16987F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859007, "uuid": "1be5de77-0c93-4000-b75c-860d9667a0cc", "value": "384:3H9wxbJ8UKypdiYLHdMWn/rnBLK+WQqrhr5VqXIezszjaQDNueFdhymdGUop5h5y:3HLD2diYN/luQArrq4eAhJuMs3Uozny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859007, "uuid": "21763223-183b-4765-b919-cdbe090932c5", "value": 26304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859007, "uuid": "1b13ebbf-b78e-4fe7-b03a-7bf5823beaaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859007, "uuid": "6e156ef2-ab6a-4875-8921-7697345fc0d2", "value": "ee99121a939d76031fc1232189687885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649fe7f0-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885637, "uuid": "6f5470a1-a82c-47e2-acfe-7d8aaf5a6df7", "comment": "Malware payload", "value": "3f12fe1e95ad61ac08dd5c5683273f8e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885637, "uuid": "a7f1856c-93d4-461d-9087-5bbeeed71f9e", "comment": "Malware payload", "value": "78cb42a3d3258408e1f7762f3a5d8f770a3401feac255760c4aeb153025c6def", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885637, "uuid": "65c9c0df-24e2-4356-b6ae-9e5327d5b71b", "comment": "Malware payload", "value": "cba4452547b21a6b2643d659c7984e18cda7e53a", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885637, "uuid": "4bd1a3e2-bdef-489c-8c4e-4027f6b0cc93", "comment": "Malware payload", "value": "fc65bcd801e04e279b0b15d49e7027b838247545e10a2a0660d9eae57074e56908845dc268ce59489959099e1cdedba6", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885637, "uuid": "ab750b49-7702-459a-926f-b0ea9d4547e7", "value": "T17DA2E8832714A14CD2034659FFEB7844413EB093FA5A48D8F311185AAD7A9D8E6EF73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885637, "uuid": "4d99929d-f416-4fc0-922b-c284bd0f0568", "value": "384:2j7WGsPeqVl5tIOhmkHUByzfMHTljhdq/+besrmWyeXVR/AhG2Df3:iglffhmv4zfMHTljhdqk/rmWLT/AhlDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885637, "uuid": "c96d3088-6974-4778-8bdb-27037438beb4", "value": 21397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885637, "uuid": "501bd39a-cbbb-4b99-b455-f8c8a8ffff94", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885637, "uuid": "97674728-af6c-436b-a79b-1ec2797db99b", "value": "bad2.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197e1769-a804-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675897107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897107, "uuid": "3a130e9d-202d-44a6-a86e-661cbe4e2518", "comment": "Malware payload", "value": "0d031996514d8214cf8550a7e2d8fe2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897107, "uuid": "2a729b73-b889-48b9-88cd-8d4d0d4e69ae", "comment": "Malware payload", "value": "78e7e7ada43ff5aa2d2b25290127e17722d2ed2f1cf14ffb93c4cf534ccaddb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897107, "uuid": "33d21804-8fea-4e42-9096-867729287959", "comment": "Malware payload", "value": "11a1c76998ebe8b1bb4fa3437fbb6f896b3da401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675897107, "uuid": "acf84dc2-0013-42eb-b81d-f605ae0b5e0a", "comment": "Malware payload", "value": "46f6df61a5f976c122b1d00df9fd3f8afe6c4b064dc3db0f99f24c467c3c09c5772c8a1e91140172bff8c8073f9ddb4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897107, "uuid": "df6c3b68-6005-4b29-9695-27877ef76964", "value": "T1F2C41257A7E85132D5B467B018F213D30E39BE51AA78C317278EAE5E18722A0773533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897107, "uuid": "97f74923-d64d-4b53-b83e-46796827360b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897107, "uuid": "a86c9065-c66a-4c99-8068-72d1b56b89fc", "value": "12288:YMrby90MPyUG7GIbs0C6cRxepoGhqOJvlyntvr4:zy561GILCDxeKGjlMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675897107, "uuid": "0d5a5ffd-9a26-4136-bb5d-1816a9944cbe", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675897107, "uuid": "aeb1220a-bc1e-49d6-870e-da538b637f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675897107, "uuid": "b6433f75-22d7-4d94-9326-f136e798be45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de38e8b5-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675881546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881546, "uuid": "5aa775ea-9a35-4717-a842-4c1d254a6d60", "comment": "Malware payload (Formbook)", "value": "e8d3b32498e5e99659f3bf2f986b6753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881546, "uuid": "9fea898f-b553-4686-8898-93ec7caf9323", "comment": "Malware payload (Formbook)", "value": "79154967c5c96d4889b209da5e2c12af4e5663795b6b7ab3f7aaf2c9779e0dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881546, "uuid": "59ebd839-3461-490e-80c3-c627aed037ce", "comment": "Malware payload (Formbook)", "value": "726255a379396d5b10ec898528d258941ac91ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881546, "uuid": "a64ae4f8-80ea-436f-9dab-37c06f40980f", "comment": "Malware payload (Formbook)", "value": "8e3f2d5f2bc73c686f91f63805c17de286f587ff17535e9c65a8685d6bb6d6c75b67a5e7670777a8ab061292f15ca37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881546, "uuid": "6d8ace93-0cf3-4b99-8fa0-e10ed524b259", "value": "T11B9512177676DF10E2852BB0C48B853843A1D602FA77F34B3F5E52D9AD823B589867C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881546, "uuid": "26a3e1f8-e599-497b-a2df-dc273d88bb00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881546, "uuid": "5d62af45-b5aa-460c-b6fa-8da3da006cb5", "value": "49152:KeCQKH+cpqfgZzBjyT9mULHtr0SjFXRClLReYEXI9mpC60DsuQaO:KFHpg2zRyTRr04YE49mpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881546, "uuid": "36a06e2d-d35f-4acd-b2b6-6910cf847d2d", "value": 1967104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881546, "uuid": "310b8aec-1f52-44af-8a5d-7711ab74fcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881546, "uuid": "8236fa75-2e74-4a9d-baf8-cdaad6dafb15", "value": "CC Checker AcTeam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fbd89a-a751-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675820539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820539, "uuid": "6d4bfafa-89ac-438e-88eb-654f0a0c88da", "comment": "Malware payload (Amadey)", "value": "e82973838eff0a7068343a2a7380f40c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820539, "uuid": "7046a830-4de8-4ee4-bbc8-bf8671ae0734", "comment": "Malware payload (Amadey)", "value": "7a4cec45d5cc5d96b6b6d1c54f9f043b2c518ee4ccccca51f1749e233f8ec2f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820539, "uuid": "b01af74f-6f03-4553-9995-b33e19dcf002", "comment": "Malware payload (Amadey)", "value": "e12ccfa46207493506b914f7dae3c6595355c23d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820539, "uuid": "d43562ab-1a91-4f01-b24d-0b0f4e9e6329", "comment": "Malware payload (Amadey)", "value": "e8e9f954bc03bf047e8a67d6d31914743ea2c612c9383fa528a0856a449a9a264d36c34411f3684ab5c79be0a19f4f7d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820539, "uuid": "fe4ccf74-95b8-488f-bcdb-94fec784037f", "value": "T1CFB4020BFBE88032D8F857B019F653D30A367D525F78879B234B5D5A08722A8A631777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820539, "uuid": "7335ec68-c4fa-4f7b-a0b4-d3303f5ff36b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820539, "uuid": "df5a973e-a0bb-4dc4-a411-566f1484bf02", "value": "12288:aMrGy90uv9dwzKdXbZD7VWUHbqQlFdVGdvLWD2V6cPOs:oyd9dcKLN4sdlFrQWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675820539, "uuid": "3d5c425b-8292-48c0-a999-685e96c70592", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675820539, "uuid": "cc3b3f0b-e9cb-46d0-9b57-35980aea2d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820539, "uuid": "7737cb43-d76c-4930-b712-d0679b2dc18d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02adfe3-a7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675871134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871134, "uuid": "a41ad0c6-c5ec-4709-ba2c-2f5da9d6831b", "comment": "Malware payload (CoinMiner)", "value": "4bf4fd4b51c4f2f5aae673a5047636e2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871134, "uuid": "713cef93-3027-4cd8-89e7-4b0c4b88f6b1", "comment": "Malware payload (CoinMiner)", "value": "7a91065736c5cf8cba5e9a87014d6fae2f2a8175c5bc6af97ee4624fbac26f50", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871134, "uuid": "79cf7914-49aa-463a-b60c-b809abe7bbeb", "comment": "Malware payload (CoinMiner)", "value": "1a411991a74c2234fa7db9a0f763a963ebdd9cb4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871134, "uuid": "c26c701f-2190-4822-89d8-6b7ea7783099", "comment": "Malware payload (CoinMiner)", "value": "13bb43eb76d76c85eae817d35b4552715757ff9f392bc2a42ff22573aa3db04c295f007685af0b8d6f8ac9d68ef10867", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871134, "uuid": "09fc1c11-774d-4341-a007-d0ac78ba12c4", "value": "T13F95BD14B27DE811F294AA34FB657FDC3810BD0979194A8F27C8B2CB97F6771590BA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871134, "uuid": "2969fd84-5d0f-49f1-aaeb-4b384f602caf", "value": "c8b03f94148253220121a62d8eb007e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871134, "uuid": "83ce37ff-dcf2-44bc-99fd-cbcd976bc61e", "value": "24576:C5y9Ag+0FR1xgaS4A/TjmiAqOtJFUhiUU0IGy9d7gLBM+W11w8qja/MzLsy:V9Y0zSSqOtJKA8C8y+W3oa/MzL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871134, "uuid": "74df6bac-d68c-4cc7-835e-398b2eb6547f", "value": 1999136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871134, "uuid": "12dae077-5fb6-4712-b0d7-08f763517528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871134, "uuid": "c1a22a31-a3d8-40de-bb55-a5bc6704b5cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398b9cb6-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675882129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882129, "uuid": "714f0480-0172-4b1e-a58b-5b9de07bfa04", "comment": "Malware payload (QuasarRAT)", "value": "0824550ba1a007280cb76495eda67b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882129, "uuid": "af1eae45-bfaf-4af1-b582-1dcd1847fa58", "comment": "Malware payload (QuasarRAT)", "value": "7ab781b52e8889ffa0085b6725c5be6ada4e5e4b47b630bca8d092ba211f748d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882129, "uuid": "c77c8e76-a0e4-4412-8b38-4e2aacf87b7c", "comment": "Malware payload (QuasarRAT)", "value": "decb316800fdb77a67630b511b7805d8fbfc9dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882129, "uuid": "51f50061-81a0-42f6-8c3e-3599cd317504", "comment": "Malware payload (QuasarRAT)", "value": "2a22a583804d7967cc9daa6c31c30d7857034e99d2dcfe74c4b87ab51cda4c944e170a3d21cb4146e2d49691d8bd8f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882129, "uuid": "dd7b5191-08b5-4810-a500-c8c7f4ebe636", "value": "T1CD451241E5C644B1E2721E324839EB1569BDBD202F30CB6FE3C43D6CDA715929638BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882129, "uuid": "c80a12d3-debc-4011-a9dc-a37993c68a65", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882129, "uuid": "295b696d-4ec5-48ac-9e07-8d97ac25d873", "value": "24576:wNA3R5drXeD8DlNWI7EwujXj5ykkix1qR7jaABIeYnOOA2LuSZ3yRFhacQ:p5cQqIwwsXj5yUreHaAenzukiZacQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882129, "uuid": "b1d414a6-51f6-4edd-849a-22c7d57b85ef", "value": 1217769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882129, "uuid": "5a0dce7d-157a-443e-81f7-31b262668f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882129, "uuid": "507984b9-195e-4485-aa04-18997638cadf", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c342c609-a7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675860456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860456, "uuid": "c4e2bbe3-bd26-497b-96d7-6af5022bd8e3", "comment": "Malware payload (RedLineStealer)", "value": "96ffec2b1ff1c8788be050188924d755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860456, "uuid": "0d2a0040-65f0-4a76-b4ca-2b2e91ce939d", "comment": "Malware payload (RedLineStealer)", "value": "7b232548da3e6b9b310ec549d252d382b81ee969f69dbcdab717aaee84ba0342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860456, "uuid": "d0c1851b-c04a-434b-86e3-9ca04801d6d4", "comment": "Malware payload (RedLineStealer)", "value": "fc3f7e6db78ecf1d0ac59014858779b10a5e9b1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860456, "uuid": "b325e3f1-1dc0-466f-88ec-e101e36d7262", "comment": "Malware payload (RedLineStealer)", "value": "9efec52b284a2f4b0b8282b604ce67b1e6bdb6dd55550ffcd2d65d3f55f04d4ae47346ca216b881152a549224a0e590e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860456, "uuid": "01ca7bcc-740f-485a-82b4-44f5f5d88e8c", "value": "T153C4020BF6E89032E9B597705CB303D309367FA26A389357524F5C1E18726F4A2357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860456, "uuid": "68222431-2307-408f-b7f5-3ce3327d7c7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860456, "uuid": "7c82934f-05b0-4f74-915e-403db7832a71", "value": "12288:/Mrly90dWi0zbr3aTdhq4YUCPxZlYXJBqtu3Ul+/cGK:Oyti0zbr3ae4Yd/Y5Y2WOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675860456, "uuid": "632e3226-2423-4cb5-a76e-5d3b99ac98a7", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675860456, "uuid": "3ae6680d-294a-4139-8bc9-0b2d608181ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860456, "uuid": "00ca5514-8d29-4f0e-929a-8ccf8827f418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeabc6d5-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675852261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852261, "uuid": "7ec5e103-949e-46a1-bd41-08d7197d1e2d", "comment": "Malware payload (RedLineStealer)", "value": "23548992c110b5de744554b26bffbaea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852261, "uuid": "3a46f2b9-d65a-4a0c-9904-ec3b46e327b7", "comment": "Malware payload (RedLineStealer)", "value": "7b34edafd780808e764b3281ec78d583361ca3d89056e996f14fd864ff5804a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852261, "uuid": "c3e26967-59e6-4091-88bc-632e40ad48c1", "comment": "Malware payload (RedLineStealer)", "value": "f17de7faea16196b047284946038afdd9d3d002e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852261, "uuid": "ba5fdd3c-3e48-4c40-8052-22100f615099", "comment": "Malware payload (RedLineStealer)", "value": "908c7c04a65ba26d3fc2669d88816a4150fdcfd84c4a4afccaff222155492c8e27053015adb2f6eddf76df4afe928805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852261, "uuid": "a5323429-f208-4c56-a16a-999a385dcbe7", "value": "T19E947D53A3E07C48E5259A33EE1FC6ECF60DF950EE4B77693219AA5F18B0072C963611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852261, "uuid": "04bb0233-a34e-44db-aadb-b7864aa68b40", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852261, "uuid": "116ee527-49b4-450e-b65d-d6c60b75d2a3", "value": "6144:ngbW1RQD3NsdS+0LQ/96gVx6VZGnLjmUMqhYC1l8EWUj5koIn:nIW1Rc3udB/wIOoPmUPhYxExdhIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852261, "uuid": "34bbcbf2-4406-4f97-b86a-063b9b84a550", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852261, "uuid": "a09d5ead-cdb1-498c-b5f6-4b92d34fde3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852261, "uuid": "f489dd1b-343c-4ef8-aabd-6ffd2e4cc5af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7765150b-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880944, "uuid": "6a9eb208-2b93-4595-85e3-48fc65af2969", "comment": "Malware payload (SnakeKeylogger)", "value": "07a7565fcf8ba9b08b5e83e94489e4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880944, "uuid": "077abc3b-0372-4b71-9d9a-46a19ea73ba1", "comment": "Malware payload (SnakeKeylogger)", "value": "7b5951f5bf8b74c9e9f377c59ad305a671735c9f7c6cf9f3def654c5989619ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880944, "uuid": "7e9c78de-1b34-41fb-9018-952544b01756", "comment": "Malware payload (SnakeKeylogger)", "value": "8cee31beae3baabf4c1e71a114a3b2623c798ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880944, "uuid": "959cca2c-c1e1-4ac9-9195-e6bd514643c4", "comment": "Malware payload (SnakeKeylogger)", "value": "f87c3c2eede8e071b16b5e90bb6d4e7461affd39593995cc6de9f5ed13a800a43b9ab3a138c712c45dedd158a2adc603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880944, "uuid": "0faf491e-667b-4372-abcc-f556098b666f", "value": "T17C64D154D27A527BD0A25DB306D2AED40BF0537B8D13E23F44412B889EF69F28D51E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880944, "uuid": "03e48bb1-9697-443b-a979-c96dd1beb430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880944, "uuid": "5f5fa6ed-1bf5-4d86-aadb-fef0d7efa24a", "value": "6144:4e9Z6dubKLoGWi3xCeLy4Im5Q1FoFVjOMix6S2:f6dubKLoxeGnRklhTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880944, "uuid": "b38a0cca-256e-4f68-b62d-303c1d7267b6", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880944, "uuid": "2049d73a-6b88-4eb6-b34a-db64a17b6afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880944, "uuid": "5717e183-38ec-4ce4-bb6d-1b97b85a03ae", "value": "Profoma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f4798f-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675881641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881641, "uuid": "fa482978-5314-4564-af5c-b575e8b8e8e4", "comment": "Malware payload (RemcosRAT)", "value": "7dab20b07d4aa77f0509daca206d2edb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881641, "uuid": "ff1becbb-731e-4b33-98c0-cb8bd95e3df9", "comment": "Malware payload (RemcosRAT)", "value": "7b7503fb09e159bf0d25b6b072d00c43460485dd668715fb1150539aa63a4651", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881641, "uuid": "5a692436-7217-420f-95b6-5737b1108bb9", "comment": "Malware payload (RemcosRAT)", "value": "4dbebc27bfcef9d17d0f3dfbadbe348fff9cc037", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881641, "uuid": "ff067ccb-b4f4-4cde-8ce8-b145bff09bc8", "comment": "Malware payload (RemcosRAT)", "value": "75cbc92e17b633c69d0108363eb11b00edd8e7761df5600e23c6f89a790480d69b57e29e49feec4aeaa9bbcdb632b090", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881641, "uuid": "c8a55d32-e65a-448f-b71e-de189041a0e6", "value": "T149438C109F8601F6EFCA96395F8D0A94D469CD7AD01ACF157DAB12497E0E008BE3BE1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881641, "uuid": "84e460f4-7db3-4613-b3f2-104276b5a435", "value": "1536:fyFv1iZc3glkU4p1rOQhhBJnyEPvD5CcCLU:sqRlkUQqK3yQvD5CcCLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881641, "uuid": "40280553-9ef4-4ab9-ba72-3303f7536fbf", "value": 57935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881641, "uuid": "593a8b6b-1551-4d03-8161-2c8dd8553168", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881641, "uuid": "cf819101-946e-4631-8c8f-f9cb15986256", "value": "Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea4e859-a769-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675830651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830651, "uuid": "925aca1d-103e-4db4-ac5b-63896e96a1cd", "comment": "Malware payload (Smoke Loader)", "value": "971f53b08fd5442b2766ea76353b7757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830651, "uuid": "c6fbfaa2-d0fa-467d-be44-9238e4aafecc", "comment": "Malware payload (Smoke Loader)", "value": "7b7ef0a827b7bf71fa595e2784c11a8ed774af05a56c7335716a326b33b1a6c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830651, "uuid": "17b5c972-5982-4f08-a0ca-5c95830c372a", "comment": "Malware payload (Smoke Loader)", "value": "5a1b99788ff7399c6b4e6ee62d7b119f071a4be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830651, "uuid": "dc0f9e49-2488-415f-b849-b4b69d7a18dd", "comment": "Malware payload (Smoke Loader)", "value": "7c4c40d47a0913a04e38ccbfc6bddb66ac274796f63835b267985683d84c07e26e8db2524c06585d87c3d9cdc82eb4dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830651, "uuid": "a476ceca-ebd0-4c5a-a108-8eb79a2fecfc", "value": "T1E314E02236C0C0F2E07715344825DAB96FAEB83156B8D95B7BA807EE9F302D1573A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830651, "uuid": "eacf9567-9416-4c3b-83ef-798ff3781f90", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830651, "uuid": "911533e7-d12a-43f0-be83-5ceea97c5dd4", "value": "3072:vzwOIi10prcBLGImjWOa5i2IHDoweTT7BzwzCYBuxW1yj6WC/Y8b:vzwkwQLRmJrjoweTTNQ3uxW1t/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675830651, "uuid": "289ff3f6-14fe-46f4-bbc7-c6025ca8233e", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675830651, "uuid": "70c0b773-9560-4ece-9e25-95e4c6aedeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830651, "uuid": "8b3e4808-f878-4911-8af3-4c655fba3122", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac724f27-a7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675859558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859558, "uuid": "afc061fa-48ac-4caf-b67a-63a880a56840", "comment": "Malware payload (RedLineStealer)", "value": "6c80ccce4981b0c0b1b3ed166eeb2258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859558, "uuid": "ea529f0c-5727-4ec7-a63a-bae1e68f8882", "comment": "Malware payload (RedLineStealer)", "value": "7b8c42da3ed5682528d538398caad942aa9ddb9fb3d2ee9f863bc0011930de6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859558, "uuid": "d44b84ab-e34e-4372-af41-c9a06d92042b", "comment": "Malware payload (RedLineStealer)", "value": "3ae093a183b57863d58a67dc93daee1b12146fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859558, "uuid": "18d5f331-1b42-4118-8aac-b674bc6d17b4", "comment": "Malware payload (RedLineStealer)", "value": "1154c6c1b352b4a72efb6e4e56961b0858bcac7265b9b2f854a05ad9df2789c0aa12152de1adcaa4d13431d64676eadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859558, "uuid": "cc6e0c28-6b18-4416-81f4-5d686cbbb942", "value": "T132948D5393D07C48F925CB73DE1EC6E8F61DBAD1EE1A37693219AA1F18B0172C563212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859558, "uuid": "99a47563-a695-48ce-9dab-c6c1d7cbbc40", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859558, "uuid": "753d5f53-2f41-4aa9-990e-014055b127e1", "value": "6144:AGBQbxQR0z2tqafJyjKl4p89jIWUj91byIn:AmBR0z2tqafww4p89sxRcIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859558, "uuid": "9aa7dad3-140f-4323-a6f0-40c0c1450ba6", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859558, "uuid": "3d4e92f1-64a2-4841-b264-379033bbda2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859558, "uuid": "68106de1-6051-4006-bdb7-c7e4b414bb6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba32553-a762-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675827640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827640, "uuid": "a722e656-90a6-4d4c-88e2-6d6d2fa456bd", "comment": "Malware payload (Amadey)", "value": "82ceb97a9b62552ee971b479e033f771", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827640, "uuid": "a85c2faf-a6ab-455e-bc47-653a9fe93dc1", "comment": "Malware payload (Amadey)", "value": "7ba13b48de98631df3b53e0e069bd17d8ff87281b85558683cf77c6ee1558753", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827640, "uuid": "3943990b-a641-4416-bd88-d8a71079e6f2", "comment": "Malware payload (Amadey)", "value": "2c978a758f143d498c56567f3770ead8f75460ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827640, "uuid": "21e88274-6133-4d64-b5f5-a6c0c1eb3bda", "comment": "Malware payload (Amadey)", "value": "5c10d2c45c757898565e5e9860be44849656ac91daf01dadce4b7d499e94fb8be9f12a6ddf90987d480def9c952b92cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827640, "uuid": "edc16069-09c5-4805-9509-3a5d259f0bfc", "value": "T1DFB40147E6EC4026E578677018F202D30A3BBDA096385757338E5D2A1973AB4E27637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827640, "uuid": "8fdf9563-5d22-45eb-afaf-c6b56e947b80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827640, "uuid": "7cb34818-bf9e-440c-8a90-6834accac67b", "value": "12288:kMr1y90D5oJRj19MY64m8fnBh/WIjuGZ:pyZjjU4mMh/V6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675827640, "uuid": "09c17d3f-98b2-48a5-b56e-c49bd3b6f7a8", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675827640, "uuid": "fc0c1fbe-cdbb-4d22-bb59-46c61096b649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827640, "uuid": "1376439e-d3b5-4a3e-bdb6-848878aed0c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a010886e-a7d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675876717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876717, "uuid": "0c8abf19-ff52-4935-88b3-52bc079a5856", "comment": "Malware payload (Amadey)", "value": "95c6b9acdb8d20b9765538bb82f99968", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876717, "uuid": "7d4f8bbd-1932-4f06-8d00-747af8d7c66c", "comment": "Malware payload (Amadey)", "value": "7d341c9ae3b04bfc6f259f8f5f552f6d95e0c26fe2bc791ea751e29f130f008f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876717, "uuid": "8d39c020-c408-4e4f-ae46-1267f4d3edeb", "comment": "Malware payload (Amadey)", "value": "e7dac300b6079cf94dfa10d5253a1abfbf0d9ac5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876717, "uuid": "2bd27ed8-af33-468a-9132-d18782df88fc", "comment": "Malware payload (Amadey)", "value": "67ec34f67748461f45bf9dc093cd928c31173c9b34f680589f1dcc08ed96079c5414f97b83c3226530ac9d10035e556e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876717, "uuid": "11c036f5-1516-426c-b7a4-cc8eaaf3cd26", "value": "T1E7C40257B7E99022E8B067705CF642C30A367D615A39839B238F6D4D28736B0B63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876717, "uuid": "af3691db-5a4f-4819-9341-c536da856b23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876717, "uuid": "dee86f66-b908-4856-820a-3980478b2403", "value": "12288:KMrZy90NQ+o62RPY0HLgPK6khPUmmmYcML:7yv+oFD8PJkVmiML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876717, "uuid": "85f31ac0-6054-4597-ae7f-5fff07458ceb", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876717, "uuid": "22d23ca8-e77d-4ec5-be29-fb6a76b29f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876717, "uuid": "7feb52d0-8404-40cb-8498-b8e308467884", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b985c7-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881565, "uuid": "89c20f3f-34fa-4708-a20a-0b7a72509778", "comment": "Malware payload (GuLoader)", "value": "84f3d45749a8fbf516a9fa3366b29e26", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881565, "uuid": "489b6114-7ecb-4176-a05d-f7437c98a9af", "comment": "Malware payload (GuLoader)", "value": "7d4aad4ccac671a9a98a5205380b89553b30fccbbf90b477a3e19cb4f9d2c55f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881565, "uuid": "d07d355a-8b60-418a-b4ce-b9d4ea35c17a", "comment": "Malware payload (GuLoader)", "value": "6c5c766ceae655caf5468da5b41346eec0602cc7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881565, "uuid": "65db078d-a181-4b71-a5aa-0346595da7ad", "comment": "Malware payload (GuLoader)", "value": "034ba1ce97c1a1d90d69e206044b41459ab921fa0680be57d026a58a8c537ce585412cf7e2e3d2d06f377a37eb0996c6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881565, "uuid": "e1e56918-bc8c-43b9-8cc6-6e923625cdc5", "value": "T15DC35A70EF091515080F27BBAFC71A66D43A49666036903BED98B3CD1713748BBBFA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881565, "uuid": "0bf3dde7-47dc-42e3-8078-50085ad63e45", "value": "3072:FXDq3Cj8LqSZ9Qy7jPLWCuHQq0mug5yzf:1Dw/mg9QyXYHn0muPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881565, "uuid": "196c5266-e4b7-4baa-adca-9a712242dbb9", "value": 126808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881565, "uuid": "ca72821f-56f0-4a18-88f6-c6d08849039d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881565, "uuid": "f89b4124-a04c-4078-b3ef-250b809f2910", "value": "Transf....vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c533db9a-a7db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675879786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879786, "uuid": "62524f9c-237f-4ef4-aaf2-93f89ea2a1af", "comment": "Malware payload (Amadey)", "value": "679c694445c1922fb11a2a174577003d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879786, "uuid": "7a06bd86-cba8-46d1-9f7a-244909328b70", "comment": "Malware payload (Amadey)", "value": "7d7ae08e684627449ef60418870875bbe85f70e1343aaf78ea726ad8db84834a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879786, "uuid": "afc91662-6c55-4d91-a82d-afd64635180c", "comment": "Malware payload (Amadey)", "value": "e6fa6d571533b36d5ece0b62e8b20806025744ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675879786, "uuid": "4be419f1-8b1f-41ef-a37a-c56b52771956", "comment": "Malware payload (Amadey)", "value": "527018b9b3f30a18e6e97039d61edc4ceef8a88a6ba9d4419f9526e6bb644de2627c8f242bdcddd25c8389a147ec5dcf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879786, "uuid": "329a7bc2-39f6-483e-9773-d58139c32fd9", "value": "T18EC4020BE6EC9072ECB4177459F603D30B367D656B3943EB324F59A918B21A0B1353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879786, "uuid": "91a32288-3928-42cb-89da-2459b8aa83fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879786, "uuid": "5c66d49d-2f8a-4689-ac28-9a3bb97eacbd", "value": "12288:mMr3y90lgJ7ptB71CpiTHl4tOWDFjakeKk1p4Gu/50:5y7/4K2IWdeKk1HI50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675879786, "uuid": "5c2b5308-c0b7-4530-bc9f-07b80b7f06ed", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675879786, "uuid": "41ca385e-336e-4328-a909-84172a6112af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675879786, "uuid": "08d4589f-437a-40ea-83a7-353b80c9516c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0755eea3-a744-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675814614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814614, "uuid": "a3dccb37-a0fe-45d9-aeab-5b9abfc4b141", "comment": "Malware payload (Amadey)", "value": "133654cc80d06b0ac4d3170bd276fdc1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814614, "uuid": "b90ede66-5cc3-4935-9417-ae6dccd27fd6", "comment": "Malware payload (Amadey)", "value": "7db5db0da0b5b5eb041b62aaf536adc77bbaa263ff1f4d10e42a4bd40c21acb5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814614, "uuid": "b9617312-27ac-4137-9a22-cd77866302a7", "comment": "Malware payload (Amadey)", "value": "24350ebe791ef1d0c592d75cbfc5545330f0491d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814614, "uuid": "5e0ee2e0-b247-44f7-8100-5e1a466372a1", "comment": "Malware payload (Amadey)", "value": "05122c13909f1d2cb3fe1520ba359757209d8f72c33d76c4a1d5bdb73a263bbb9ca3eb1c6aba6a708186b319582a22b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814614, "uuid": "a77b3a42-a5c1-4450-b2d1-066ecbe51daf", "value": "T107B4021BA3F84033E4F467B014F703C30A3A7D915A38568B364AAD1A1C726B57A757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814614, "uuid": "3054776c-8089-45e5-8621-f56a7fa980ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814614, "uuid": "1f2fe887-77f5-4ec7-9932-8370d582e96e", "value": "12288:9MrJy90PcD0T9wUktxJkPRy2cJdd6cXWt6e60pR:IyUjBwUkZkPsN9PXWtz6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675814614, "uuid": "971b08f0-9cc6-4c05-a3f9-177c8b60fb00", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675814614, "uuid": "0664aa5a-3cfd-431c-b751-51f22be93866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814614, "uuid": "98dce7a8-5a11-4506-9127-517330fd3cde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c617d5-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675881151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881151, "uuid": "dffd81da-3b24-4d4e-8802-7c5f59d9e579", "comment": "Malware payload (GCleaner)", "value": "e5e0787212cf3d4d701495f0b5982217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881151, "uuid": "202ccc02-1549-4318-a273-213846625c03", "comment": "Malware payload (GCleaner)", "value": "7e0067e4b19865f84379e850be8299f20b845d0af4af52d47e77eb4e50987837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881151, "uuid": "486cf6c7-2e9e-4dea-a012-176f2f0efb24", "comment": "Malware payload (GCleaner)", "value": "debfe450a9a2f8e042e5730a73565d7ecffba2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881151, "uuid": "645d654f-ed96-4b66-b9df-a1792674e263", "comment": "Malware payload (GCleaner)", "value": "e135c9c0f4cda65280e1a019256bf0082b32f856ca301b377750090c75b56732d32b6e01d52fd3caed3b18a62d538ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881151, "uuid": "00176a5a-4f31-4eb8-be6a-68f0faabf80a", "value": "T1ABC5127C7201C8ADC280FEB4883AA9E75CDB6DE3E9E4A46270CC7F3F5279184561A517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881151, "uuid": "c7c360ba-efb1-41a9-9959-d8d41a9a8802", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881151, "uuid": "b03e5409-cae2-416a-b7d9-1a80d17a9afc", "value": "49152:rdHycea3+a2z5NIrx3KMBZVQ0HPsKUomSby8hDQGa+8mUNwILCgv2MR:JHheauabx3JZ7HPbxmSbyadOmUNrv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881151, "uuid": "0f208a4a-cf00-491f-aeb5-2625d07c75ce", "value": 2684722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881151, "uuid": "3dc70f12-3aa1-40a0-b90b-125c34af61fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881151, "uuid": "0777c11a-e813-48cc-8d6e-a8c5df8d9281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4580d5da-a7b5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675863251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863251, "uuid": "fafd3edd-2b0e-4691-8761-2733d670b5f8", "comment": "Malware payload", "value": "6c799655021de65e3c173c5f90591169", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863251, "uuid": "a63b9379-6cbb-4d33-84fa-2fe40449aab0", "comment": "Malware payload", "value": "7e4bfc1f18005823a3f03ac802fa84ae8dfa025d937e4ce434322369f8f592c6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863251, "uuid": "459c6134-2978-4e29-90d6-51473d4f883d", "comment": "Malware payload", "value": "025e6bc438cbdd29198bae2b85d7d7d3cdac1382", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863251, "uuid": "0d5f2427-26f5-4d2b-b096-e99aabef455d", "comment": "Malware payload", "value": "f9cec53824fe786c5c5c68f123c914e1ef03721b31491d8ce937aacba0acab0bc5f65cb291c529c0244fd604d1826e6c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863251, "uuid": "37c56ef1-2da4-47c7-bae6-8204b7d8fa91", "value": "T1ACB6331276DBCE36EA3E05B0B13D961E8215BE210FE094EB63D45E6D0E729C1077AE47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863251, "uuid": "58b77b3c-2984-4378-bae7-7ce09d76fa7c", "value": "196608:HWtAsJoutPVfLhMH3DuC0t/zUbdMAEhHWMeniUivS/QBeWgYNs:2GGVtThQ3DuCugK1enitq/rWgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863251, "uuid": "dae13e7d-3fad-4fff-b0c3-0e7e2723a66a", "value": 10980352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863251, "uuid": "e5cb93d0-dc8e-49ec-bbba-92618428a358", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863251, "uuid": "f6217c48-b106-4cab-b1b6-6cd3ed7d9390", "value": "DUMENTOS_DNLOAD_MAILS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f705ca-a74c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675818076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818076, "uuid": "0cc66bc4-50f7-42a7-9a18-6e12a59cfe4a", "comment": "Malware payload (GCleaner)", "value": "38f50d61c6466d5723a267a08ad0786b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818076, "uuid": "ab4901f1-25a5-4d67-ad3b-c91df0a517fe", "comment": "Malware payload (GCleaner)", "value": "7e7958ea4dbf2978818e8acea6ac438b11eac049905effd6f06aa60309a82daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818076, "uuid": "f6b4ecb4-3c2c-4da3-bebc-be106edaae87", "comment": "Malware payload (GCleaner)", "value": "100440e02b2e3d3ee2c940eb1fd226062c64c59f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818076, "uuid": "395b382f-61aa-4ba0-9667-1735d81b563f", "comment": "Malware payload (GCleaner)", "value": "788e4e5575383ebd39ed6e127794f90ff9ca07081a744888a2d108e2f97f603523d653b6899ce6c7f3db6e92a5e6eced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818076, "uuid": "e26e0611-21d8-4e1c-a15e-b974aabbe0e9", "value": "T131D5E01A5C94D0A7D1608F70D9D76DF69C12EE6FE8BA409313003FFBB631246A85AD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818076, "uuid": "436a1c71-f2d3-42ec-a0e5-238ccb4d89cd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818076, "uuid": "425fdf9e-abbb-412c-b4f9-6f8a2cbcc4ef", "value": "49152:wDaldlfjAaxyKimne0rPIr9U0GTZxjt2RTJi5ekPLCgv2MR:+ifjAaxycne0rwxojgRT6Xv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675818076, "uuid": "983bb0c2-5f18-4497-80be-70768f22f1bc", "value": 2745683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675818076, "uuid": "90809290-8e87-4439-97af-85090938b871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818076, "uuid": "c4eeeb62-b735-4be7-87e0-16798781955a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc4a908-a7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675860443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860443, "uuid": "6bcf2257-2f87-4e94-b601-c054f1c803df", "comment": "Malware payload (Smoke Loader)", "value": "a21331c7c9323667b5248df2567a343c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860443, "uuid": "29cadf81-151f-4687-96c1-7f76306871b8", "comment": "Malware payload (Smoke Loader)", "value": "7e7af2c0f792b6fe5db5ea9b6d4b4ac159f800a9d13f6016180a4122dcf9c6dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860443, "uuid": "6f5a547c-817b-4d77-b583-0667ed64b676", "comment": "Malware payload (Smoke Loader)", "value": "3ab65da20b8f3dcbc9190a7c4de0729b407a298d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860443, "uuid": "2d404553-3fb5-45f2-bc50-825f1c711fc7", "comment": "Malware payload (Smoke Loader)", "value": "f65672f40d1424b7892b2c04daf74d1d0d487addc37aca10bf7207c93a8c3d9b7a82d780ff9fa832932fe8c62791f957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860443, "uuid": "1b82b1b5-aa1e-4cc6-acdd-6926bf1fecf2", "value": "T116644B53A3E17C48E925CB73DE1EC6E8F61DF650EE4A77693218AA3F1870072C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860443, "uuid": "20c0673a-a9d8-4a87-a1e8-9e22514ff4bc", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860443, "uuid": "a6d79f5d-a80a-43cc-b9a2-438353c94957", "value": "3072:wwwqToDZ4gGtRlNUqjgAJrCkEAreqAcWv/VN3/dfvoWByUAl1PuBWnU:w9kC1QNJjgAB9xqlv/fFfAWUj2In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675860443, "uuid": "92a664f8-957d-42df-8e61-3401736ede10", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675860443, "uuid": "78d631b8-5fd7-46a0-964f-7278793479f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860443, "uuid": "7e22993e-1550-4df6-b13a-5a1ec5cb3ebb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a81b56c-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675882130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882130, "uuid": "5b323f28-903d-44bc-90a3-922aa8cf9d86", "comment": "Malware payload (Rhadamanthys)", "value": "1c446ef1ad726f7d72af6774695e5f81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882130, "uuid": "6078e28c-541c-4c6d-b51f-ba5be9c5bb00", "comment": "Malware payload (Rhadamanthys)", "value": "7e90c76f4110c159f8e495903c322d2867f555c66d8cf9a61ec561bd91f3c1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882130, "uuid": "eab99844-08e7-4b5e-84cf-90e171d69bd5", "comment": "Malware payload (Rhadamanthys)", "value": "71363d02e649feb7748c4a7e78a4021ffb6fc626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882130, "uuid": "fa758b58-f7fe-4b31-88f5-07b103cce12d", "comment": "Malware payload (Rhadamanthys)", "value": "f93ed7ccd4fb29d32c9f1e5eca87e5e9bb6c52c936828cff2ad54b73a3f2479f6d2c5e8bf0acdefe6aa348f656d547f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882130, "uuid": "118cdc78-42c4-4ec8-8838-e23c63b38df7", "value": "T11044E0223A80C072C56B653C5C24D7AD6BBDB83052B1CC177BA80ABE5F706D3977634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882130, "uuid": "588183c1-712c-4114-8c8c-28fe19f400c5", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882130, "uuid": "b359ef4a-081f-4109-ba1b-5d45b052def6", "value": "6144:2d+dziL2ngv/k5lsv7Sqt8g2V8ZHAFb2c5eK:2d+dziinLUvec8DCHAFb/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882130, "uuid": "3945b504-8f10-408d-b371-3c66f5291f09", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882130, "uuid": "61a26005-3c35-447b-9d69-b5b956e7f5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882130, "uuid": "2d655901-1b5a-4d1e-8147-ad8b5bb22b94", "value": "1c446ef1ad726f7d72af6774695e5f81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae1407-a7f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675892315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892315, "uuid": "e0d3c759-6f78-4366-8fb8-526caeb41e6b", "comment": "Malware payload", "value": "6b8e4e8a5c895b7a3d67ad295b88bd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892315, "uuid": "c4d3a6cb-f0e4-4b9d-8403-3b17d631895b", "comment": "Malware payload", "value": "7ee51a71317b023d68e5c46e54e778a3e8d59d5454c1b16f858b4f3457b400c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892315, "uuid": "06e5ffb4-3e6f-4db8-8451-0921825ee718", "comment": "Malware payload", "value": "0767eec4fbd03426bce62469aab05cb6864d12d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892315, "uuid": "2dd91c6b-6c46-448b-98fa-455f5dcd5978", "comment": "Malware payload", "value": "607738d43d8467c2528f6d899585e7d941094a269b38b0b62872ced5b84ba0d079ecc09d96c387b7e879839ec40b541e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892315, "uuid": "22d566dd-28f5-41f9-a8fc-544361e9aa05", "value": "T10DC40243B6E84033F4B15B7018F602D306367E656B38579B278BAD6D0D72AB0B53276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892315, "uuid": "99142ce3-3913-445c-9532-ad0026811fd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892315, "uuid": "a2c07209-2187-48a5-8157-340d2de9d20b", "value": "12288:kMriy90Q3SKpJqje77RjuD37M8x3t22rBSN0igZ3PBOIf7N4Pn4/bFD7Uxv:ey9SKpJqy77Rj83g8dt28BOcN4P/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892315, "uuid": "496b4ef4-8530-4aa9-a82a-6e160cdf606a", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892315, "uuid": "97228a68-08b0-4219-9ba6-c9c2a0193b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892315, "uuid": "45fff764-f8c5-496d-abff-d1ab913f7c88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3d48fb-a767-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675829790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829790, "uuid": "3b2d6fa5-d777-4be9-92b0-31a46237885e", "comment": "Malware payload (GCleaner)", "value": "73bff455ea6b6822e9024e7c7f946a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829790, "uuid": "ccd2eca0-44ff-4435-b069-f5bed59c8efc", "comment": "Malware payload (GCleaner)", "value": "7ef8912b250ecbd86e37a8ca9405a9681435e4a89d5f486925bf13353d978754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829790, "uuid": "8671001a-ba97-4c6c-85aa-4c5ba497ee71", "comment": "Malware payload (GCleaner)", "value": "09c180cd74fb2308bcc1db85a2771f14aac784c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829790, "uuid": "38d0c7cd-bd36-4b7b-b206-a17e47c4c558", "comment": "Malware payload (GCleaner)", "value": "a959cb0ecb61ee7150ba864ab0d9bab56df01df17e0146a3cd6e2fc26866d225fe5e1efdf78a579677345a3942499889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829790, "uuid": "a5b491ec-08e5-4550-8d2c-1c67ae3aee12", "value": "T1DBC5127CB545C9AEC180BEB48C2A94E76CD66EE3D894A06370DE7F3F517D1889B09107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829790, "uuid": "cde054db-86ed-4eb0-8fe9-3d5d1d4afdfa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829790, "uuid": "426a7689-ef48-422a-bf68-9001762c6452", "value": "49152:pEHhvm5O5dOCMQKd9ijUh6P+Pz+zwpjF4RllfEZWuT8NEjLCgv2MR:6H/y9f62PCMpjgllfEQuwinv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675829790, "uuid": "e17d57cb-8921-4d19-8b7b-f518e94c7bca", "value": 2696799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675829790, "uuid": "379d80e1-85b5-4e6a-9c23-0ce46e480710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829790, "uuid": "59777382-bec8-4e9c-bca6-9c6a55a6c462", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6565015a-a7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675869747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869747, "uuid": "765f949a-1a45-4209-82a0-8d0f90cada8b", "comment": "Malware payload (AgentTesla)", "value": "50b9d16e7114947dc107c3c9bb533c98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869747, "uuid": "1b455051-3d55-4438-b122-60229f8c35b6", "comment": "Malware payload (AgentTesla)", "value": "7f2e5e961d9baa2bb3adc5b0e158cc9b17aa57239ba7cf2313979b4a0c521efe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869747, "uuid": "9ac5a213-82be-445b-9a11-d5cb536a8940", "comment": "Malware payload (AgentTesla)", "value": "9419d65b737278753d09cb011542005a6b29e90f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869747, "uuid": "84ede2cf-af3d-47de-a8b1-8a6b05552f4b", "comment": "Malware payload (AgentTesla)", "value": "b61e84371bdd2d069c92ed14a59bc587bfc8a51364a459669d6035cf218249c10838a02db2901089ade7bc64009edaec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869747, "uuid": "0004b9c1-3039-402e-810a-b3cc70ee5ca8", "value": "T12D0523D6B8B880F7F17305A1E35C89DA2644C6D7B7789D78702729325D7AF22908CBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869747, "uuid": "e1c068b7-eaa4-4e8f-8204-dd92703cfc68", "value": "24576:y3zl1NXM8ijzfYdWQ10pFxwrE1kTx31R/T7Sc5Qq:y3xzc80EdWQCps4kTxHCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869747, "uuid": "228c3b26-6183-4f50-aab7-410a419aa313", "value": 846633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869747, "uuid": "f0f60c3a-bf45-4be2-a0b3-3db081f4e464", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869747, "uuid": "5118cf0f-60b1-46f9-8dae-a4f8aad92057", "value": "AWB NO. 1456977583.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323fdbaa-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675882117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882117, "uuid": "4b91f6eb-2ef8-4f6b-9c56-09acfaf5aa4a", "comment": "Malware payload (Formbook)", "value": "f1d47099425f01956733f4c46fb1ae12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882117, "uuid": "e3a7d5c8-45d7-48fd-8e4b-f1542b4b6186", "comment": "Malware payload (Formbook)", "value": "8006ab2944380f5aa422230ba36c98f4476f7e9fbce7c128875510ff3ab65a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882117, "uuid": "9a9839bc-5e78-4b54-b7c8-07d6035bf395", "comment": "Malware payload (Formbook)", "value": "1ef1cdcebc008a6b59dad6da4b3f740439a7201d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882117, "uuid": "054ff4a5-fce2-4017-aee3-4690dc49e193", "comment": "Malware payload (Formbook)", "value": "78aba2ec379b9a1009df88f9d3e9a90e443b527f55aaf5aee11571ec00cf69111e2f9627d866a2e2efb81ecdf74fb850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882117, "uuid": "7638e5b0-878b-4e6f-807b-2019141511f6", "value": "T12AE5F9247BFA502AF2B7AF759AE039965FBEF6237706E54D1061038A0913B00DD9163F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882117, "uuid": "df282fda-c4b0-4c32-96c2-e789ebeedc3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882117, "uuid": "5e846861-0bc8-413b-a292-d578666ef3f0", "value": "49152:Oh0FIUV6acWJD+exmMbzE8BOx5mhzep1gf0yVD6:OmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882117, "uuid": "6df331a7-d144-4a26-b796-862535b511b1", "value": 3143168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882117, "uuid": "7704f8d4-aa54-4230-910e-3e22e5a5b649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882117, "uuid": "992ef592-988c-4107-9cff-fb7f020a9ec6", "value": "f1d47099425f01956733f4c46fb1ae12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936df6f7-a7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675874978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874978, "uuid": "865bafaf-6304-4df1-8cd3-2e9c2093ecce", "comment": "Malware payload (Tofsee)", "value": "275e25771ac2e46c69c7fd21b2fefab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874978, "uuid": "b0cff9b5-c44a-404f-9f65-837e4a572bd0", "comment": "Malware payload (Tofsee)", "value": "802a735f5e68ebc1524b5ce305df7dcc6e3f6dbb66a278c5bd03e7552fe33f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874978, "uuid": "f8bc45f8-8553-4d44-abb0-08fd4802c64a", "comment": "Malware payload (Tofsee)", "value": "080d93c524495109d3bdc571b433da186f20717e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874978, "uuid": "eb8ca2bb-110c-4770-be0d-2bb7b8c1acab", "comment": "Malware payload (Tofsee)", "value": "ec2052f2b3fe6fa337a4e7e2d80f604718e2f256aa3f4be86c57316bbedd66a98dc65af88c00212a012ed28f87fe7e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874978, "uuid": "c74f8ebb-1ca3-4580-abd9-2746ed9da571", "value": "T1F4641803D2E27C85FA658B7ADE1FFBF8765DF5608E4AB7653218DA2B10B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874978, "uuid": "70f5d30f-1346-4147-9300-ab10b19ca308", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874978, "uuid": "cdf47362-00f0-4476-8957-7f830b46e32b", "value": "3072:zPgfRP1dxR9nkAEsaW4DrYRAr4rgbqK4/d+p/sWQDiuLp/VX9v:z03rAXDrYRS4E4/ekLiqrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874978, "uuid": "644413df-5a12-42c6-aaa4-c45b88cb6851", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874978, "uuid": "1fb0885a-26b6-48fd-845a-4b97db32a6ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874978, "uuid": "38abfa3c-42f4-4611-8865-3af0511fbe57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ef2028-a80a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675900061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900061, "uuid": "2b3feba3-1477-4883-838e-386e59a162aa", "comment": "Malware payload", "value": "aa6f5570b814e336cc91e57f1dbbf22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900061, "uuid": "c815ca62-501f-437a-a41a-05d246cd1640", "comment": "Malware payload", "value": "80e6a9079deffd6837363709f230f6ab3b2fe80af5ad30e46f6470a0c73e75a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900061, "uuid": "6ba95e44-1152-4762-8cae-cd9d28ee0dd4", "comment": "Malware payload", "value": "3d022052c70ecc34dfbfac318b05ca7e6ba4a244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675900061, "uuid": "f82be1f9-6640-4c41-9f01-2ef115becdcb", "comment": "Malware payload", "value": "e49a412240f54a92531fdbc57808e4b82136f48cbb6754dbf2464479b101de20b4823f06b6b9fdb6127513854092b068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphiron", "colour": "#18E75D", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900061, "uuid": "63ecdfd8-daa9-4db0-9bea-0535ad755208", "value": "T1C6D64B43F89141E8C1EDD170C62A9263BA707C844B3463E76B60FBB52B73BD4AA79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900061, "uuid": "565e1e46-a700-488f-8cab-1622ed397774", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900061, "uuid": "1105959d-74a3-4b89-aac4-f3b69251099b", "value": "98304:zzlmXetyTHb4woPqhyMe8qctl186npfyCfMypJQECa24kcB+dYHjSGIc4:1CeyQmhnjwCfMypTC3HcB+dYHjTIc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675900061, "uuid": "6df6d620-b905-437a-8af0-577d7f8b2bf4", "value": 13253632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675900061, "uuid": "438b90e8-810c-4d67-9cd3-e6ec6a3748b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675900061, "uuid": "33da0440-06ad-46db-b9cd-2a4b93b940d2", "value": "stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c70db6-a7ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675860076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860076, "uuid": "92c23219-c466-475a-8168-b910130c4020", "comment": "Malware payload (Amadey)", "value": "c9e1187aea26c967fad15fb066c48b1e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860076, "uuid": "fe06a56f-a36d-4f54-b330-02edd10156ad", "comment": "Malware payload (Amadey)", "value": "8184ac46ddaa040dad8ca701135242549e446eef1f0cb6cd23804c096f3253a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860076, "uuid": "b3d904b3-8ee4-4f3c-a7b8-053ee2c80428", "comment": "Malware payload (Amadey)", "value": "b50460441e012a524e946342fd675c0fd87b7617", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860076, "uuid": "5986f5ba-54ca-4e90-9a32-1a528b0fd038", "comment": "Malware payload (Amadey)", "value": "6f273df31ab2af0af0ec17910bc0897a5c3e7233ba0ce227116a74fbf841b00d5e115bb0c0ed0b94d181a4b786fd673f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860076, "uuid": "3673f481-1f2e-4889-9d96-f10f2164ee70", "value": "T1D4C4020BA7EC8133E9B157B058F303D31A367E516A788357638F9C5A08735B4A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860076, "uuid": "e75e017e-7552-4fa6-a399-e966fd75959f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860076, "uuid": "c2a99e34-f59c-47ee-af10-60699872d65c", "value": "12288:CMrWy90OhEhV18Ndaom5epdhq4Y8CPxZl+VJAUNp5aLj:YybuV1M3ue84YF/+nAypYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675860076, "uuid": "11653268-b0b8-4781-8ad7-ff3d423b4153", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675860076, "uuid": "c3a9b167-bf9d-4ba0-b374-f524f20e54b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860076, "uuid": "58c88cba-3067-4a3f-a025-91517cb84137", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400b25a4-a7f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675888582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888582, "uuid": "6ce2663f-8c83-456b-b56d-e5559df713ab", "comment": "Malware payload", "value": "33adb114e321ce5f01e6b5db170c5f98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888582, "uuid": "ba2aea95-8aa1-4b66-b108-a621da3ee688", "comment": "Malware payload", "value": "81ca0b713703f65adafb4e461aa13dc4c2d323c389b519cea70664b9b708c929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888582, "uuid": "7de67ca9-bd61-49ab-b4ba-d8a8508c9ea0", "comment": "Malware payload", "value": "25769f0e52ebbf018dc765d1ed73178d36f261dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675888582, "uuid": "45feee10-99f9-40b0-8a45-a44b7c053c11", "comment": "Malware payload", "value": "2a64af685b5fad5b7dfe3bad595ac524737faacb2ad149fbd8a88426f76ef685e1e2e8e4022d8739978be20d6f2a6eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888582, "uuid": "28b36edc-000d-4a5d-b819-3506ae0fefeb", "value": "T16F641903D2E17C85F9358B769E1FFBE8764DFA628E4AB7653218DE2B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888582, "uuid": "480d91d0-f2c6-4162-9ff3-2728d8ff50ca", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888582, "uuid": "f5ce02be-2de5-4fa5-b634-9bbfc30e771b", "value": "3072:dPgh+1cd4dxR9BkZR7b5enLRI8dG9t/T1uQVSsWQDiuLpJ5gv:dy+TrBkfHsW8dG9tr1uYLiqJCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675888582, "uuid": "ef732d34-f9f1-4759-a950-f7311e3270c6", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675888582, "uuid": "275b2289-dcc2-45ab-8f5f-dfb316977406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675888582, "uuid": "1301ef28-989d-4140-9055-1889b4740821", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d424f1d-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880927, "uuid": "8228ffbb-668b-4314-b620-91a6426bac9e", "comment": "Malware payload (SnakeKeylogger)", "value": "9a65aa04b53fc65457c934dff2fd5d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880927, "uuid": "72103b75-0b29-4b47-a790-a9d1525bdd75", "comment": "Malware payload (SnakeKeylogger)", "value": "81d9661cb388676b8ac07ee0f5581f2095c68afdb8349c80217c5e39c1f1566d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880927, "uuid": "4d80cd3d-2f32-4b56-a0a4-36936eb86c13", "comment": "Malware payload (SnakeKeylogger)", "value": "8eba7fbdab4e94be04ae0c49c206fcee9c03b65b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880927, "uuid": "60017794-e561-4bd0-8352-fb842c93d155", "comment": "Malware payload (SnakeKeylogger)", "value": "7af445d584d1e3eb8881c663f67ec0cc8fabaf951ac0fa382c8130c23bfb3d29bc3568e3665a19fba1d7c422e3c99889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880927, "uuid": "9954d4b0-ec3b-4610-aaab-32f5bd98f9e9", "value": "T11815DF0623D4DE42E0A643BD49B2DBD01373B979D1A5EDD89CC22CCE0A25B60B9577CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880927, "uuid": "f5d2fd22-b9ed-49be-bea1-fe11e7d2efdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880927, "uuid": "c806f24f-742d-403f-aba8-fbb9e4bf6cec", "value": "12288:1QWlV/DfrpsPiwfO6+k8458eW8bQRwi0X7AlQ7yThP4M/Qe0iIsWlV/:XlpDTpyieO6+kL8eqSGQ2VwMYeWlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880927, "uuid": "70012e13-d139-4f8f-9973-833ac1031dc3", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880927, "uuid": "5499f42f-fa30-4cbb-87fd-fa70e2a6cd8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880927, "uuid": "0af0bc76-19d3-4771-8440-bc44ff224d75", "value": "9a65aa04b53fc65457c934dff2fd5d96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0dc67d-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675852228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852228, "uuid": "dfa3df30-bcc5-40e5-b6a2-ccbee5bf83d9", "comment": "Malware payload (DCRat)", "value": "67fcec7b7810e554d7b211e848c36922", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852228, "uuid": "b3e44e65-9cfc-4274-a1c4-df74718fd4f0", "comment": "Malware payload (DCRat)", "value": "81f41d482bf4095fdb19e769bd7284412258e89e9c5ed1fe9363ebe17dbcd803", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852228, "uuid": "954c2fd2-4416-41e7-83b2-7f344517d36a", "comment": "Malware payload (DCRat)", "value": "f0a51177f5261c01e975d6654bf0638bf4fbf2de", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852228, "uuid": "d2733884-7ecf-48fa-8ee9-8dba8c6fd43b", "comment": "Malware payload (DCRat)", "value": "a957d802ce719398ba004a822a3c3b80a7f7dd06df23e6822d8be9aa6f1213d251a9acc308b12edce7057353e44400bd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852228, "uuid": "21f2564d-197e-4d48-96c5-82dbe829d481", "value": "T132D44B242AF96D25F1BF9F79D5F028AE8B79F9536753EA0E049103860A13741DD80B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852228, "uuid": "a5a92526-b4b1-46dd-b452-76cfe31215b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852228, "uuid": "60e64e93-4104-48cb-b7e6-58462c81ef99", "value": "12288:TqnOLxNtOFUn9LyBLLVpYkFtFDK/QJ8SCKE4fI7Vd2JDxo/Jy:T+OL9+rSkbN8gUda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852228, "uuid": "a4aa1c84-50d6-4321-a87f-6e405a0fac40", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852228, "uuid": "d5e75b65-c4ca-496f-ae9c-bc551246f8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852228, "uuid": "223e3e2f-5463-4cb8-b420-cd8f9ab313fd", "value": "HEUR-Backdoor.MSIL.LightStone.gen-81f41d482bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a857bd-a77b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675838339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838339, "uuid": "bff09157-5439-4e3f-a3ea-a5013a30e236", "comment": "Malware payload (Amadey)", "value": "8282d8cb398dca69906d2a3c4534ddc1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838339, "uuid": "08b0c06e-c0eb-413a-9b1b-7734adf9ce4f", "comment": "Malware payload (Amadey)", "value": "820c1a6522691b4fbf1f693694f9032009f59270e2f27887a49064733b90f954", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838339, "uuid": "469213b7-2bf4-4501-b39d-186da3889dc6", "comment": "Malware payload (Amadey)", "value": "3eaacd8a3be6066901e725f2bd2338d6611214f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838339, "uuid": "29781702-0494-4e20-a151-171313aa0b9d", "comment": "Malware payload (Amadey)", "value": "4bc81e9e2ee2fff2fae966f86c0fd3bcf3ea26931beff3432fcc866c0fbe1584b346de1cfd79e4ff672747af83f75c6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838339, "uuid": "3017a759-7b0f-4076-8884-5a9d2044f7ed", "value": "T121C40257B7E84033EC6067B159F206C31636BDB25B38929B238FADA91C731746530B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838339, "uuid": "a9ce3919-50cc-495a-8b9c-5709a4a2bd5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838339, "uuid": "420d2396-f107-42e8-bf54-2ae6c46007da", "value": "12288:jMrLy90ES+nrpYWhSKusu2MF7nHuRCJvopkSLBb3NTeBVN:syljn9FrufF7HwC1CN6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838339, "uuid": "b7ca1b5c-5f3f-4d32-87ee-6ef6e2f45714", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838339, "uuid": "29a44c13-7969-484e-a625-3887edd577b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838339, "uuid": "6b588e7c-0ea4-4640-81fb-af78c18f098f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90267810-a7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675860370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860370, "uuid": "a1cc76dc-a97a-4128-b548-1b519d6a99ee", "comment": "Malware payload (GCleaner)", "value": "a9e7d3c51d254d627cb0c1a8a2827faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860370, "uuid": "24ed3297-63c9-46c0-9520-ac957dde8cce", "comment": "Malware payload (GCleaner)", "value": "823379fc5a061b2ea856e5ad7394a2865d699a422a085d64b35dd58e8775656c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860370, "uuid": "5f9036e6-8960-4b7f-aded-799f734b9669", "comment": "Malware payload (GCleaner)", "value": "624e2b1636c0a6b59118f11ded13e5391f9f3b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860370, "uuid": "d51ff511-7df4-451a-96c9-7eea882906cc", "comment": "Malware payload (GCleaner)", "value": "a22d395baab2763f61f7f1a34ed1c5f917186a4970ef210cee7792dc7cc643b6cd8aee6ede8437994e8eb39b28fcbea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860370, "uuid": "f16aba77-d5ae-4c39-9ce3-499c3e52cd08", "value": "T12FC5127C7145C86DD680FE788C3AD8EB5CD66DE3E9A4946270DCBF3F45781889A0A207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860370, "uuid": "975ce8ad-6ec2-44e6-b958-509821aef68c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860370, "uuid": "0f923c3d-02d0-40c0-ac4d-c9d20df9318c", "value": "49152:rdHDwTGpCnC5gGkoJivXRSP2L8RxpL4psCOLdsxLcdTOC6PeWVZLCgv2MR:JHUTtn/G1i0+mPL4p+RODl1v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675860370, "uuid": "035e9f9a-fe6a-4c28-8547-cbc1f3e04b8d", "value": 2695444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675860370, "uuid": "07633d6b-b79a-4e94-87dd-4d33dea0f82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860370, "uuid": "f9a2a1d3-244e-47d6-9ff9-1e85c3090cdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328bd452-a7cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675873098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873098, "uuid": "0d5ac1e1-3341-47a5-872d-2de8e5725eca", "comment": "Malware payload (CoinMiner)", "value": "cce672d0eca50065b51b8633031da1fe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873098, "uuid": "fbe9b578-db64-41a3-bee7-3fc50d9050b1", "comment": "Malware payload (CoinMiner)", "value": "82702eeff19468a5eecc62d93a6131cfcb3e356b112a9db4fe18f8ec05873aa7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873098, "uuid": "4c2df005-7b9c-4ee3-aa55-be021ed17def", "comment": "Malware payload (CoinMiner)", "value": "1733397be5c0a5bbbb47d6857126172e714072c0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873098, "uuid": "c1abb096-4da5-4c6e-94ca-be3d384d1279", "comment": "Malware payload (CoinMiner)", "value": "531592dc223e276e6f471689c3715b230cbc13d0c64358fbd0b19256215f2224acca66682b0235b08f0a6b61e9a40dac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873098, "uuid": "0c6d28f1-0d36-4c7d-a71a-b78f1630c9c1", "value": "T1B1641913D2E17C81FA658B76DE1FF7E8769DF5608E4AB76B3218DA2B14B0072C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873098, "uuid": "9cdfa651-97dd-4512-9d91-4866f5e01836", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873098, "uuid": "a38449a1-cfda-443b-9835-6fb40471af4e", "value": "3072:UPgr2j95dxR99e/72GXuB9sHrzXhDrNdfnsGmtyXU9r1tWkLPxWsWQDiuLp/9m1M:UZnr9e/SZ9sPXhDCAX+HLPpLiq/01sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675873098, "uuid": "71dda30e-5682-4fe6-a3f7-3c69b5776764", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675873098, "uuid": "5badaa75-c142-45f0-b40c-cf5a0688f187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873098, "uuid": "51565594-9869-4347-8627-e1b01aab74c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d83cdc5-a7a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675858164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858164, "uuid": "396e870d-ea73-4d70-afd6-ba0bf06a165c", "comment": "Malware payload (AgentTesla)", "value": "7e27729f780e9da172d75ff02d84120a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858164, "uuid": "785e90c3-6f00-46ba-ab08-e77f15379464", "comment": "Malware payload (AgentTesla)", "value": "829fedfd6f7e2d6dc3476e2ddb808b305fa4a3fe47798eafbd56419afb727ec1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858164, "uuid": "a1880cc9-d158-4252-920d-119a84c41503", "comment": "Malware payload (AgentTesla)", "value": "fdc10d9b61cc24061e59cc6ff84be8ba88926566", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858164, "uuid": "a2dd820f-c05f-466f-a220-1c9509ec3be3", "comment": "Malware payload (AgentTesla)", "value": "68d060e5343171909cd26f4e1c00c37868df2d2db14fd3f7b0ebe669e7304cfd4524949300532d222e6e498c5ad938e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858164, "uuid": "dd48e301-ce36-4a5f-8cc2-8faad2617aea", "value": "T1DE64227E7F774210354D6A34A8C06443AB22F9F5EAF64AD1C21C95712A8CED80FDA2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858164, "uuid": "4fe250bf-7302-4aaf-8c0b-d4533d80d05b", "value": "6144:g/jUb7Z48G42uQzEAZfBQnfx4S6nLvnlGVsUe6W67wXa2rAZazCSM6:grUbVk427zEcQfSSUvnlGVNZWiwXa2Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858164, "uuid": "dae10f69-ba13-4c1a-8b72-0cd388d94d86", "value": 311431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858164, "uuid": "a5cefd0c-68aa-46af-8970-bb60d2f3d279", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858164, "uuid": "496d7ecb-555f-44c0-8866-a437583db81b", "value": "SHIPPING DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5199ca6c-a7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675872291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872291, "uuid": "04004e42-5df7-44c1-bc6c-7afc903bf3fb", "comment": "Malware payload", "value": "8a41de728fa6261e758f2f1bdb6b76ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872291, "uuid": "5aab261e-6666-4da4-934e-92b065fadab2", "comment": "Malware payload", "value": "82cdaa8e3d8a67e7253431f84545ddccf1006fa2edaaab932669e89eded3ad5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872291, "uuid": "c2c62cd2-846d-43de-9575-2625aae71565", "comment": "Malware payload", "value": "023fdefaee2de963645d01bfa10b3e0c4a94c3e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872291, "uuid": "cb40d46d-c4bd-4635-a4ba-587618fadf5b", "comment": "Malware payload", "value": "a563e6302ed57200a21179ad2154566d7cb208cea329d76b9d6b48fe4dcd4dd79d6f6b56b833893e8b882b004b0da663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872291, "uuid": "84983cad-568f-4582-a7ae-b12459103815", "value": "T141163326F5C0C437C0B14BBCCEABD6C4167DB7B96D242A0B71E1DF9C493A241672D29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872291, "uuid": "553f7f3f-df46-4638-a9e4-ba175fa80780", "value": "baa5b88b6bb86e914d34b43be035dc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872291, "uuid": "7fffc27e-0477-4b3c-8678-11c31bd9d51b", "value": "98304:62s3B+mw/YuS9f0f47T0Ghhh5RTliQm/MKPtV0znKsyVWFPU:Rsx+Uf0A/0GrFC/fVpsyVW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872291, "uuid": "e91e50d6-a66a-477e-adb1-cec54ac9c060", "value": 4279035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872291, "uuid": "d46e5174-e998-44d1-baa6-1385afa8e4cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872291, "uuid": "5882eb15-ba6f-486d-86b3-09c3a36be095", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bd3744-a743-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675814549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814549, "uuid": "1492f9a1-6eee-430b-b878-266d67b60157", "comment": "Malware payload (RedLineStealer)", "value": "a79fe2a04eba4ca479e68cc208e5c589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814549, "uuid": "ae7ba0e8-ce58-42ba-8cc0-97126c2f97f3", "comment": "Malware payload (RedLineStealer)", "value": "844c4d52c4119841ec0c3388d4baa75da3b7101eabfc7953bbf519820e86dd93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814549, "uuid": "11af5cc0-e041-4318-983f-345e0b304d79", "comment": "Malware payload (RedLineStealer)", "value": "0d02c99f2ac80b5790167d322ad238e0b5f2e0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814549, "uuid": "1acee152-dd49-4aa8-87f2-0fb149684264", "comment": "Malware payload (RedLineStealer)", "value": "6a709299a32cc0e194544ae01b4de43041422e0d9851ad918c191a5e020b2887638f9e9de65351d1ea172f41fd8d7324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814549, "uuid": "76551853-bd11-4e66-a169-d582f244c4bf", "value": "T1FA64F1313680D472CA6620788C64FF609BBEB43052F589577BA51BB99F306C1A37B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814549, "uuid": "08f7cc68-2e78-4cb1-8b66-b9681fc32443", "value": "ae0d5a157fa4c5b2c2783d24fb5ee840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814549, "uuid": "7d24a6ad-45c1-48ad-b5ec-4d159418e133", "value": "6144:5W+ZVCL08DBIwUBQYVPaJJiydu/pMSxRMWL/C+:5W+ZVCQ8Oq4PqJlcrLMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675814549, "uuid": "b2420555-371a-40a8-bc78-bbc18d16cc2a", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675814549, "uuid": "1b18e9bd-e6b8-48ec-b917-3f6bdf47b8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814549, "uuid": "91801363-62a8-4d03-8900-13a76dfe9e36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6105974-a775-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675836059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836059, "uuid": "8529ddd1-ccd7-4a38-a71c-029b9eca0977", "comment": "Malware payload (GCleaner)", "value": "eb713cd8166fdbee59df4d22362742e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836059, "uuid": "7123bba0-656b-43a0-b955-944816fa739b", "comment": "Malware payload (GCleaner)", "value": "8490bced7199a89876626a48ed580ca8e9816acf5b61390795b712d23028124e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836059, "uuid": "8a3bb3b2-465a-459b-98c2-b869c6f07f48", "comment": "Malware payload (GCleaner)", "value": "bfcad6bbcb6c2e0b5e6c044a91e46761d2b12fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836059, "uuid": "6e60988f-92d0-46c3-b5cc-d392bdbb9a75", "comment": "Malware payload (GCleaner)", "value": "bbb21e612461c1c28482b1e16e9b950de775cb13e4e94b4fa3ae41d2fbbc28f6db54efe9c9ee9fde6933d35902f2f2b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836059, "uuid": "f54c98f6-a186-4ea2-9e66-850888293075", "value": "T1C0C5127C7541D4ADD680FEB4CC3B98E75CD66EE3A8A4A46270CDBF3E527D188860A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836059, "uuid": "d38b8c6d-c12e-4e96-b2ad-ba47232f3bef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836059, "uuid": "dc6c124a-7ed8-4ccc-80fe-a19c756c90da", "value": "49152:rdHhpJNm24Oc9kSiGPUJAkZ7HQ3aRqmfPrxJMg0DLCgv2MR:JHHmy/Si8kZjqaRZfPrAg0Hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675836059, "uuid": "c33eb04c-ec84-4441-b8ca-14c2e3d08c72", "value": 2680562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675836059, "uuid": "46538387-8470-4714-9b0e-d77f1809fd90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836059, "uuid": "bc6d7ab9-3814-4c76-8d57-1884e4d4cf91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5282d7a0-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675881312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881312, "uuid": "e8720634-8115-4a7d-a4cb-451567adb144", "comment": "Malware payload (Smoke Loader)", "value": "110d22f1358521542c59bc7733898ee6", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881312, "uuid": "29972e9b-d4fa-4879-a324-e9ba01dd21f8", "comment": "Malware payload (Smoke Loader)", "value": "84af1a50f7c8a1713fb4390ce709609d467176645e4af97ae45c0957b80692e9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881312, "uuid": "f2870537-2ee2-4894-82d4-a47e120f284f", "comment": "Malware payload (Smoke Loader)", "value": "d4618f8d8f2ad6180eb00ee0b6fc2285f276e956", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881312, "uuid": "09535faa-bbc6-4877-b152-3423cc1c3fe5", "comment": "Malware payload (Smoke Loader)", "value": "18b14c4786769a91c6f491ce188772bb7e8578c4fce089d13854d1bd07dd3522eeb70d1053ab5c091b15eb430198b7c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881312, "uuid": "83fdc24e-15d0-4f67-85ba-30335724e248", "value": "T14514D0323590CCB2C46A11705C70DF64ABBEB5309279CA9777A817AE9F302D056FA397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881312, "uuid": "8f44ac15-0aba-468e-a511-b3d033d7cf57", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881312, "uuid": "6c3b8312-e1c1-42b4-826f-944fe09eefb6", "value": "3072:NkrLOC9oLk6ERL1G/W135V0WMds91nspKZpoJu3q4Bq:erLUERLQ/fWMa9BXSJx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881312, "uuid": "ffb87d85-31b3-46e1-915f-231a97dcff20", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881312, "uuid": "150fe223-ef19-4809-8d68-eb4a105e71e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881312, "uuid": "3290a227-a122-441a-a532-e98487876e9d", "value": "110d22f1358521542c59bc7733898ee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b9ab7e-a7bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675866760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866760, "uuid": "1e45dab9-3bd9-408b-b798-4cd392a15fe6", "comment": "Malware payload (RedLineStealer)", "value": "313b09ed469f7a7291b7f3168bdec9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866760, "uuid": "338b57c0-b1a4-4b5e-9e06-e66727a68a05", "comment": "Malware payload (RedLineStealer)", "value": "84dc02e7536e6e43ecf9b93a842ed9c878ebb270bef654ab2cf4ea5dea8435d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866760, "uuid": "338d5db8-2a8d-47b2-b8ca-b3a1343b72d7", "comment": "Malware payload (RedLineStealer)", "value": "0d22e457307b44e57b1b8c6dfcf5eb7b4f7f1272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866760, "uuid": "9523750d-063c-47a2-9313-4d018bcc460c", "comment": "Malware payload (RedLineStealer)", "value": "437a6597fa14393f2b9bd37129737c4b89e4386b5d8817dea4dc7e61d97d6762ac3f97fdbd0242bd167e11a0354c489a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866760, "uuid": "8d13e31c-1557-415f-973d-32287e2bbe5f", "value": "T14A948C9397E1FC40D9618A73DE1ECAE87A1EF5D08F2E77769218AA5F18710B2C163311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866760, "uuid": "25f8514c-3343-4e8a-9cf8-653bba1b6f47", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866760, "uuid": "7eca8fbd-6077-455f-abe2-a0e5ffb2dfc6", "value": "6144:2es6OcZvQY7fDkK2z8gwU78+ssDVWb7MbW8m9vZLgtKB+:2f6O2I8hMbn68uZLgtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866760, "uuid": "abea4794-28e3-4678-977e-220db5378d84", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866760, "uuid": "b68d4145-0cd1-47d9-a684-8b9a02428840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866760, "uuid": "1148a84a-6bd4-4d3f-a6dd-977062c57dc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eee43e9-a78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675845121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845121, "uuid": "5c34fe92-595f-4de3-b842-1684231e3ddf", "comment": "Malware payload (Smoke Loader)", "value": "5eedb376af7edaa8e6ebc0d39911dab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845121, "uuid": "88f484bf-e19e-4ab7-8969-2117709cfca6", "comment": "Malware payload (Smoke Loader)", "value": "84e68e0e6473e15144bebff656de4a09722cda5b48d651532198b58f5234b6f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845121, "uuid": "b76f6b52-ce9c-4a32-a8e2-aec5bd52abec", "comment": "Malware payload (Smoke Loader)", "value": "17b4cb713a8e2efbb2e50b7a839ca10e5968f8b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845121, "uuid": "ae6e0d72-9811-4f0c-be75-847e6e8ed6b7", "comment": "Malware payload (Smoke Loader)", "value": "d16c956e8398bb35fa246b6dd06cebcc4f5a65de4568185c545d6347b1b65368bd3b97f7f9e01e152c1f6f2905d0bfe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845121, "uuid": "a156e9ec-0938-45aa-aa6f-70547a4f9db8", "value": "T162643B5393D17C48E9268B73EE1ED7E8F60DF650EE4B37693218AA1F18B0172C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845121, "uuid": "da42434a-490e-4ca7-a4d8-5092fb514b19", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845121, "uuid": "8b07a1d4-da24-4cd2-938a-9956a6401583", "value": "3072:Mw3qMtQiFwXR5cXsV7fSP4nnQBhmOONV2cyt+0WByUAl1d6lBW2:MiPtQQUWEfSP4QBhmOeV2cYWUjd6lI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845121, "uuid": "96c4d3ea-70d7-41b9-99dd-fb8ca281e930", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845121, "uuid": "ca1eb0ff-edc9-4298-91a8-0626a0e80719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845121, "uuid": "3507d834-d45a-4c57-8aeb-e6007092d8fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163ee89c-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675867896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867896, "uuid": "6748f9e6-2bc2-43bf-a2be-f04760fa92a3", "comment": "Malware payload (Rhadamanthys)", "value": "a48fda3ed389d738f423b5d471bdae0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867896, "uuid": "a9efef7c-1e44-4532-9342-81ea7ea23879", "comment": "Malware payload (Rhadamanthys)", "value": "84f6c731dc3f29982c5f07a25e3ba93652445ef4707dffde728214d8e5305fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867896, "uuid": "42151321-fee0-4c27-9b60-a6afa5b11742", "comment": "Malware payload (Rhadamanthys)", "value": "bf48e8918d7653eccc703dee8f4595757fbf3999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867896, "uuid": "acef845a-e4ef-4edf-a087-bafd5a5d6c2d", "comment": "Malware payload (Rhadamanthys)", "value": "58c3603919012601735c7fabaf0992c9d4640f7464dd16770fe917ce5fdfb2f77cb72d15989d5bb34c89e8d1ab5afb19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867896, "uuid": "d063933f-383b-4c35-aa51-12bfc5a88025", "value": "T115846BC393D2FC40E9658B37DE1ECAE8761EB9508F2E77769218AE1F14B11B2C163611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867896, "uuid": "e209d072-dc53-4c57-9b9a-f87a28880b8a", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867896, "uuid": "05509768-7fea-4f9e-80ab-acf8be04ff15", "value": "3072:vPjmxVxKRNhxUMjHhhjZhoV0BDVb3+kn3r3zZ7RLStKRxhUw3qh+:vLm/cDUM1uVwBbuqzZ7gtKB3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867896, "uuid": "550250d0-b929-4475-ba5b-0e1cdf00a2fd", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867896, "uuid": "34e49d50-722e-460c-a5e2-e3288392415e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867896, "uuid": "f6fa6d69-5c68-4984-bd0c-3d9587e6dee4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404428a3-a78d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675846062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846062, "uuid": "9e97a8c4-a5eb-4967-ae6e-a909aa20f9e9", "comment": "Malware payload (DarkCloud)", "value": "3ac09f93b6d0ca93ba3edd0ef0569ae5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846062, "uuid": "673234a0-f859-44e2-aee0-83650f144d6e", "comment": "Malware payload (DarkCloud)", "value": "8533643ccccdd517ac1b94767c93929c66bcf97177000a1b4764436dc1357d1d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846062, "uuid": "7bbfda82-01e3-4790-8060-0e285563e5ba", "comment": "Malware payload (DarkCloud)", "value": "0bcd27960d5258ec9e007dd9f2c27bab58078ea7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846062, "uuid": "8af211d4-c9a7-4d99-9fed-ec93281eb0e1", "comment": "Malware payload (DarkCloud)", "value": "4f22dd13c088bb56a8d6a6b59da68cf104d672cfac71a8c2c1bf86cbc27a93f64d0fed34b2b5cc9fd0ccbc0fdbf1d853", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846062, "uuid": "571727e9-e5ee-45e9-a723-0eb500aab234", "value": "T13B253346FB3E03FD99AD18F119BBDB09179DAC0D250943CE46B6681D22FEE693493443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846062, "uuid": "b602ce3d-8e53-4d43-bc2c-801d5cf460f5", "value": "24576:8gn4Nhxd170uqj98Fw5gFNc0FXyKWw+/jM99YRYzarGIe:8gnExd170/j9SA0x/ajAaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846062, "uuid": "f6e2cad0-33b6-4fb3-b022-93bb24dad88f", "value": 986741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846062, "uuid": "8bb72f55-756e-43c6-a261-45c4f874f8a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846062, "uuid": "ae5147d3-efa1-48ac-9f67-1b1d21a5a0c8", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaccb42b-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675881997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881997, "uuid": "6be16018-1d66-4b83-923f-6b5452012820", "comment": "Malware payload (SnakeKeylogger)", "value": "3fe895a1f53c49b32b6a2ed9490b7c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881997, "uuid": "4d5110f2-95fc-46e8-894e-9947445a646f", "comment": "Malware payload (SnakeKeylogger)", "value": "8592385cf68384abb334601fec1ecae040bc2bfada4687ccca45bb408dee7348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881997, "uuid": "5f1031dd-25f4-4186-9444-0414bba3b56e", "comment": "Malware payload (SnakeKeylogger)", "value": "d3353fbafd568897132954e05f45d82d70efcacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881997, "uuid": "02d7b848-4291-4ac7-8b7e-4c2c7ffbfa0b", "comment": "Malware payload (SnakeKeylogger)", "value": "44fd625bfbf6f8c2de2dc091a41e4aeb5f2bb60ba3258dc6779e6157954d07ad5c1ba58eea7b283bf0e6e36906d63fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881997, "uuid": "c8601ea4-1a30-49fe-9c13-aac1fb54d0bf", "value": "T1FB1512512658CB64D15807BECCB4AAF053B56DB9EC55EEEB6EC13ECE7E317912000AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881997, "uuid": "9a0c9895-6d56-4400-b428-b4ea67b6a1e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881997, "uuid": "b6378fff-685c-4d35-99bd-b4de898ba438", "value": "12288:JiJ2iNZrgzTTGhgzTbAp5CCP4M/Qe0iIu1dern5lItLB+f9c8n6b535Tf:I1bgzPGhgzfYNwMYend2cByqg6135T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881997, "uuid": "2e2fe1b5-3c99-4499-9736-4a1580134f18", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881997, "uuid": "94160010-aa73-4d3c-a134-4e21f400b8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881997, "uuid": "dc75d103-b918-4345-8ef1-bba1c0b40fa4", "value": "3fe895a1f53c49b32b6a2ed9490b7c51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a68dba5-a767-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675829759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829759, "uuid": "3a6e05f7-aac8-4f41-978b-c56c2a8927af", "comment": "Malware payload (Amadey)", "value": "a0e5accc59e151e215a116fb39c93f1c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829759, "uuid": "e350f68c-a44d-43b2-a5c8-de3bda3d23d7", "comment": "Malware payload (Amadey)", "value": "85a5f97ebdf1808db5d948071c8c3968292ad93e4c7536bafcd41b5bf60bdbef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829759, "uuid": "7801c507-4138-4457-af06-c5680dfc145d", "comment": "Malware payload (Amadey)", "value": "44db378d88906780a7bff38146f900731e24006f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675829759, "uuid": "c6a5a7fc-033f-42c2-8bef-5864d908b645", "comment": "Malware payload (Amadey)", "value": "8c0c6f7af1ab4fd6675086e8728acb629f61eef4bdad7ea777b5d8f05ad408fd335af6475255b5733057c467c6e2f8fd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829759, "uuid": "0d83df83-f88b-4cff-8af4-181445468ba2", "value": "T19BB4020BF5ED8432E8B613705DF702C31A357EA16678D35B325BAC594CB26B0A63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829759, "uuid": "3c1e7ac9-8be8-4254-9347-46d1c46020c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829759, "uuid": "1edb9d42-abb4-458d-b955-c4b7aa47813d", "value": "12288:FMr3y90vC3s6RMUYIRO8d1oECGxAopCwLRLKIrRlp:2y9lRMhr8d1ZRFLLK4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675829759, "uuid": "791f3323-63a0-4a2f-a8aa-92d849f3d375", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675829759, "uuid": "114834ec-75e6-476e-b260-926d45eb982e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675829759, "uuid": "1f1959b7-ee07-400c-a971-7b296419f2cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46424fa-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868242, "uuid": "6898d1b6-36ef-48fa-813e-5b9e62801c24", "comment": "Malware payload (AgentTesla)", "value": "a8a5fad3730cc6f04e2a518305b6ab07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868242, "uuid": "d75e4040-447c-4221-9217-d740d29ca523", "comment": "Malware payload (AgentTesla)", "value": "85feb04b14f9a5936593f9d4fae84ae840091b7a119b98039d5a5f49c4bb7594", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868242, "uuid": "b346f995-e3ed-49ea-b459-468c5da26018", "comment": "Malware payload (AgentTesla)", "value": "fff82a1cdd4ef7ee3225916e679616e5832f5d6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868242, "uuid": "f2b101f9-9433-49d0-a2ed-0075ceee111d", "comment": "Malware payload (AgentTesla)", "value": "5a6030200d714e10a9263c9ca6168cbe522d5116dbbcff567b5f3e60d087cc3ba7cc415be563fc1a81e13dfc0c08771f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868242, "uuid": "b7a66793-4441-4620-a7d1-83186003ae42", "value": "T1C8F4235906783BA7FA567DA232F14CF3195D2947683E8B2A3030871C698B4D35CE4BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868242, "uuid": "55cf25f2-45c8-4702-b994-dce8f13dc587", "value": "12288:US/gOSnifVVfdUMkCXi5VyohILAUUCV5SMWkBUShFs6QMAymjXaO2f7oPeNEvXpM:US/MA2VV1s5SX2UShAMbmzK7oeqpf7tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868242, "uuid": "b532eef0-742e-4440-971b-390dd444ac4a", "value": 763171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868242, "uuid": "43aab7a9-8cf1-4711-90d6-27ff1a187a39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868242, "uuid": "2b36fe2f-3149-4583-9610-af4c9a653a4b", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c39b2d0-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675819937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819937, "uuid": "6656899e-03bb-4985-a72f-40b9e4ec3689", "comment": "Malware payload (RedLineStealer)", "value": "b4138222931b8458a109d11cd2194ce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819937, "uuid": "de54eac5-0fa0-43de-955a-41b484a61795", "comment": "Malware payload (RedLineStealer)", "value": "8601b9efdac4733e888cc949f337cfbba4140a6a441aaefe2ab391b4d637dfbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819937, "uuid": "ab53a7f9-b6c7-4780-96a4-f1947ca49403", "comment": "Malware payload (RedLineStealer)", "value": "3b78247eea213f18d0fa745860b3099238b31fe9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819937, "uuid": "ab3f70e7-5087-4c24-a80b-78020f7b994f", "comment": "Malware payload (RedLineStealer)", "value": "fedee77df72340e284c89def022e67ecae31b0adedaed3b559c3b1fe19ea2cc8be975d08bdbed84aec7564ed190bd964", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819937, "uuid": "25227788-6ac4-4534-a54c-46a16fcbfdaf", "value": "T1C55533A6D926DA0FC7B177BC9A84D8E535C85331E38CC3CFD462A88521A592F7A04CDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819937, "uuid": "7b6f21e2-d36b-4616-a28b-f66960682c3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819937, "uuid": "93f4f5d0-199a-4bc7-8026-90f3f89277bb", "value": "24576:dpxRSasbbtRTnQ5sUm0n0m4DH5fS9Mr9CKkMcvBJsJYs45Z3S8IVej:dpfSamk5sUm0nXsCMkDBU16Z3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819937, "uuid": "8c020f04-6e2f-4b12-9a36-658df749c93b", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819937, "uuid": "861c65da-2230-4f54-aefe-49e9e370e360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819937, "uuid": "add170ae-73c8-466e-a908-4adace891120", "value": "b4138222931b8458a109d11cd2194ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71431ed-a78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675845081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845081, "uuid": "f82523b9-ec9a-4ca0-9ea6-5eb4e492adc0", "comment": "Malware payload (RedLineStealer)", "value": "afe96160c869f7416abf88e6525fc593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845081, "uuid": "6638398b-0a55-43a3-976a-42104c760b87", "comment": "Malware payload (RedLineStealer)", "value": "860327f6053f56f351aac2f88571af6b890c09800ac5514b780e599da8417469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845081, "uuid": "20da9337-aecb-4dd8-9efd-85028f10fb05", "comment": "Malware payload (RedLineStealer)", "value": "249946a5c98b08d32cfa7a3cf853f022903a32dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845081, "uuid": "ac814598-82a7-48de-bc63-d775f89b332c", "comment": "Malware payload (RedLineStealer)", "value": "b9916aed5d723c79e82f763fbcdcaec34901e3650af7018dabb5d48b002411b7fefffba81c75212a55055560113d3f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845081, "uuid": "cd016e7b-718d-4833-a592-aab769575817", "value": "T1FA948D53A3E17C48E925CB73DE1EC6E8F61DF650FE0A77693218AA1F1871072C663612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845081, "uuid": "8932e76d-0496-4f4d-b8be-c533758da468", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845081, "uuid": "b2d15bd0-4cf1-40c3-851b-e75d908d8340", "value": "6144:nKJ+S1FUZM1tMU8KZqrHx0rG/M9r2atgDVaugeuLaK96FWWUjgLOZXI5:n0+S1Fh89rOa/wr2Y8C96FWx0LONI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845081, "uuid": "1b5b93cc-e82f-4c83-96c6-6aaa89aed6c4", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845081, "uuid": "d2f3cbeb-bfd2-4b42-993f-64408bb122b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845081, "uuid": "ef1e8d43-7c94-401c-bb78-36fbaeb17157", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0fb9ff-a76f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675833149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833149, "uuid": "baf778cd-e574-4826-8980-879dadae4666", "comment": "Malware payload (Smoke Loader)", "value": "02f2954f370fb2430a7968106a6a1c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833149, "uuid": "33ccc4e3-ebfd-4f88-bbd9-8913dabea695", "comment": "Malware payload (Smoke Loader)", "value": "86e1d267fb0a50df7f0450e6e0a4c75e8a93f6d5356887990803e859bd1f1d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833149, "uuid": "1db58872-5524-4a78-8772-e181f6f49fc1", "comment": "Malware payload (Smoke Loader)", "value": "2b69de7df7c7db2c6e6b408aa813bb710aa17156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833149, "uuid": "199944ed-0b70-4270-852c-c7a2ab6e3766", "comment": "Malware payload (Smoke Loader)", "value": "f46007afb58ce93cb10f7a38621d85df755a8b5b6ec21d55356354844b448ce5c097c8f9cb8f8d469902b337ae7c4133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833149, "uuid": "3ad0b8a0-2820-4f9b-b0b8-ecf2e24f18c6", "value": "T1D714C0323690C0B2C57B15307C6CDBA46BBE783157B58A5B7B6807AE5F302C1673A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833149, "uuid": "90889019-f5d6-4517-901c-62a74bd95d0c", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833149, "uuid": "1df97904-0f64-426b-b3dd-1774930aad06", "value": "3072:qfcO19i8iCjMFLVfoWrWda5o+IZE8GgVlY7K0/gr1FFKkZaJQP:qfcZ8PMLhpr+ZE8XVnAmFFKkZaJQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675833149, "uuid": "03292474-1bfe-4de7-aeb8-2efefcb741b6", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675833149, "uuid": "4f5d7e0f-c280-4927-aece-e2fd05934159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833149, "uuid": "9bfc8ddf-024c-48f4-ac7e-f47ab0a028e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae2d5be-a7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675874883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874883, "uuid": "a281bef2-6ae6-4e54-bd89-7b0cf51152f7", "comment": "Malware payload (PrivateLoader)", "value": "9121873bd05a2502fb304043ab81bb15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874883, "uuid": "12300252-c324-4d27-95f2-1717ec4c5232", "comment": "Malware payload (PrivateLoader)", "value": "8736141e72f26d636178ec23ac803503ae5cc19c291671e1f0b89a121240b84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874883, "uuid": "2d08e98b-61c0-4585-9bc3-691100ce22a4", "comment": "Malware payload (PrivateLoader)", "value": "eec417b46979b516d2a06dffc1eb3608513452e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874883, "uuid": "7e94c803-0a7d-47c4-8658-6a2b8c4bd8e0", "comment": "Malware payload (PrivateLoader)", "value": "56b14a694d849ef6fa0a9cd1919fa040274639993ea93566ac7901539266527f9c6091ec9ab43a0bc14834c0a062415c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874883, "uuid": "54bd6a83-5f67-487b-a299-cf162eb7622b", "value": "T13B46F133A2CCD818D0949C38D656ADF267B23CBDEA8709F77BD0BD8575399E45802B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874883, "uuid": "ba7a6e1d-9dc0-4361-a838-0e775029a3bb", "value": "f51724e08a085aa5e9f0970616ead7ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874883, "uuid": "2c24ca75-76aa-4e70-b31e-5e8d02c6bf03", "value": "98304:DV5ttqgbeFsrDsNAqH4Y++a2i9jbMK/144Pv0Y74K4uzQkfS4FsWEFUq6N:DLt1beFsQHMaqjQg4wv0Y74Kzck6uEFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874883, "uuid": "9442c88e-23e2-4858-aca6-6a2796f68e01", "value": 5752832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874883, "uuid": "facdfff3-22e6-4728-97f2-d7387296c93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874883, "uuid": "e3dde6aa-1167-4911-9c49-17013f6d5979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6453c93-a7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675869561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869561, "uuid": "a3a9dd44-9b8e-443b-bdb6-15d9dc6d528b", "comment": "Malware payload (Formbook)", "value": "56c21a2796f5c5bdf12603e3e18f59d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869561, "uuid": "38314353-a7de-4964-a653-f6f6c6c54913", "comment": "Malware payload (Formbook)", "value": "8770f9d32f3b5b26267d6320c355f576df3d09e49d58e50ac16d044f4cf2cf54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869561, "uuid": "43be50c6-0bb8-4fe7-bc86-78ab688e8254", "comment": "Malware payload (Formbook)", "value": "31e7a1dd4e1d981a07d0006254cdafd7ca0c1c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869561, "uuid": "13d9cf60-7680-4275-8f8f-bb3f5473aec7", "comment": "Malware payload (Formbook)", "value": "9fcd3152ac7ef14434f39af83f828efa7e0079eb6cf666265db0a78e920e6bd4ee50eaf0563c22ac9d1cf54da8540f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869561, "uuid": "3105627e-0eb3-42d8-a1a5-db16f350e95d", "value": "T14F541290B794C87BDD610472152892356FAA6C3668BE6D4F3798370E7932183DB2F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869561, "uuid": "3dfffe26-939b-431e-b1ed-a33d2b24ce30", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869561, "uuid": "92b81154-2901-4523-8cfc-3b330604f305", "value": "6144:nYa6FM+2pDlj3uGJpZrJ52Gp0yK0Iqbu2Cz99Dzr2Oc3:nY4+21lruApZNP0yXI6u2CzPeOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869561, "uuid": "ac6733c8-33f7-4ec3-a1e6-5d3b51692886", "value": 303638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869561, "uuid": "fefc88ee-181b-4cf2-bcb4-ab66d51a9c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869561, "uuid": "999f3523-604f-42ad-a7e8-1eb59c125a30", "value": "HXM030~0.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8243f3a-a807-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675898743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898743, "uuid": "80d1f064-3d09-474d-8424-055cdee2bf24", "comment": "Malware payload", "value": "2c73f50dc51d21112c2ec3f9fc56ae8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898743, "uuid": "a583a5da-fe6d-49f8-b96d-18cce82adb5a", "comment": "Malware payload", "value": "87909c654fc3d19bcc28795d71c5c8a94f8ac0a308380a433d8e62a3a93c062f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898743, "uuid": "43318330-8aca-4bf8-8119-370a2f1c0625", "comment": "Malware payload", "value": "ec19ecf368a823f68c37266ed030e7a42aaa6178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898743, "uuid": "a5f5871c-d2e9-4006-b174-34278f1c4ceb", "comment": "Malware payload", "value": "13f3be3e97d4afde41cb55b04d8f73d2c91e4ac6d24887dc6505729d7be35f0a7f504a6ef21f36f938b898fb93b2c270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898743, "uuid": "c353fb83-f555-4577-93df-10169554d66a", "value": "T115641903D2E27C80F9668B769E1FFBE8765DF5608E4ABF653218DA2F14B1172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898743, "uuid": "0785fdf6-6ff5-4167-beed-7467f624b2b5", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898743, "uuid": "dcd4af22-594f-4a87-aa9f-bbfed76afb87", "value": "3072:SPgq1Mu4U5RFWGZcol/zaJpWbCLBsiJukrpj+XuYsWQDiuLp0gv:SdUCWAP4pWbEBFJuEX9Liq5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675898743, "uuid": "d67d836c-20d5-412b-b414-20b92807b9bc", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675898743, "uuid": "291d03a8-f37d-42ce-97c2-49fe2b5fa32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898743, "uuid": "40b3373d-db23-4970-9ae5-8f09b40fb439", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a0e567-a7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675870551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870551, "uuid": "9fc31b42-0107-4417-8196-f614bb62f9cb", "comment": "Malware payload (AgentTesla)", "value": "df3021025f56407ddfbbf335632886c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870551, "uuid": "97f8851f-a977-4974-bfb1-68c61419ad47", "comment": "Malware payload (AgentTesla)", "value": "88b90f8ff47c52df163fbc67486c34e3b3e4b5917857e6b12c7ce67f3ddf5c4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870551, "uuid": "037c80e9-5603-4278-8193-4ac4fc732883", "comment": "Malware payload (AgentTesla)", "value": "f5b816b5d03919fd43143071d7417b72015a9170", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870551, "uuid": "6c4da29d-3014-4651-8893-9316b30b1d7b", "comment": "Malware payload (AgentTesla)", "value": "14fbbd6d7999eb6e21eee266acc8b35b977d5d7579e0dbf724d8a459ea17c73ab484d7ba1e5f25539dee8b702e59d650", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870551, "uuid": "ef0eccf7-86a1-45fc-8277-facf3bcc7d5d", "value": "T13F64236526348D8FFF3A85BA9085386FE4E659778EF0A950D969FC0315883E30AC45CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870551, "uuid": "4dc21ba0-02be-4137-877b-50395fff2ee1", "value": "6144:0/jUb7TzeW3SB6jQZpsx+AREBsPHHnmiMlj+cjlkwvK:0rUbB3SB68/qYgnm/+cjawi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870551, "uuid": "47cd0c29-e807-4dd2-ba7c-181ca1333c1d", "value": 321326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870551, "uuid": "7470a1a9-62cc-4df8-9066-17e54c636be3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870551, "uuid": "2e8c91a9-64f7-471b-b27e-c29710b44d98", "value": "TT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06220e85-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881613, "uuid": "14fbe176-654b-49f5-b795-95783b5d126a", "comment": "Malware payload (GuLoader)", "value": "90f6cad58fa39455b2bd712eb9a9e5d4", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881613, "uuid": "17d86f9f-fda6-448e-a67a-514a7055f347", "comment": "Malware payload (GuLoader)", "value": "88caf41122ae930ca97f30367279b2065148a9319224e34c132eab0cfad2561b", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881613, "uuid": "f7fc1795-cf7e-4245-9716-ef3075fd6277", "comment": "Malware payload (GuLoader)", "value": "72e110e777392aa23aba252deedbae00ce93d01a", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881613, "uuid": "64e600a2-8d58-48f1-a747-1457a2d2c3b2", "comment": "Malware payload (GuLoader)", "value": "fd64cd0faaa0085c3ccc33b5e003816cf85e4c965d2c08b50e80b06600f7ccbc374344974be70cb0154a54b52a87701f", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881613, "uuid": "c2ea1019-5d9a-4fef-a5f7-b159bab9a187", "value": "T1FDC33B609B2D29158D0B3BB6EC472DE44C7D49A7202624387D9C73ED39D2348EB7DE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881613, "uuid": "930f4840-4453-4669-b8f7-fd1fd67e50ea", "value": "1536:FFHXmJmnq3Cj74LIHCWF0KcBFuw4AZfsz/1U/727jPysWIJuHhgz26qZgFfga7oj:FYYq3Cj8LqE9ly7jPTWCuHiq0fga7oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881613, "uuid": "a4471b62-6410-4387-bc1b-ee45f8ff3768", "value": 128333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881613, "uuid": "d7afbac4-d5cc-4c2e-8827-3d63edc4092e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881613, "uuid": "dd6663b1-b7aa-4bc8-9b4b-96c49aab3a7c", "value": "Sipari\u015f.28.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2c6657-a7cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675872845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872845, "uuid": "af212bb4-e6f5-441f-b7ba-ed4eadc46c85", "comment": "Malware payload (Smoke Loader)", "value": "015f189f1c2ebec6a1c296aa2ab30f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872845, "uuid": "59d14f07-a177-468f-bcbe-d6d931302b2a", "comment": "Malware payload (Smoke Loader)", "value": "88f9e19ecd6dfbe0b506c56e164d3ea904040ccf99ffd0db1469dac32000cdf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872845, "uuid": "96b9e018-6776-4aa7-817e-c9f33a6ba1dd", "comment": "Malware payload (Smoke Loader)", "value": "50583b6f5f19c30f17b1c748be54448f428a0a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872845, "uuid": "11794eb4-4593-4357-a51b-96f4d9112a77", "comment": "Malware payload (Smoke Loader)", "value": "eea2fc8d9234c6c7e456ca3aa042decb087b2fdb5cac08cb6c25945f8b75f9ac2719f631e19c07e62932448aa790714e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872845, "uuid": "e7af8d73-c4fb-4a14-81b9-f7396a3cda63", "value": "T180641A03D3E17C81F9268B769E1FFBE8769DF5609E4AB7653218EA1F14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872845, "uuid": "99a1c0b3-3d58-4000-a54b-7dc3b33203f2", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872845, "uuid": "66f90fd6-2295-4d30-956c-7ab73015c5de", "value": "3072:7PglRxIdxR9EfMwl7pvJiEG4lPAH/waKwKrwX0TCa6msWQDiuLpZzv:7OYrtwLafzKkraeLiqZzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872845, "uuid": "c774dffe-e273-4031-8901-042b0be69df7", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872845, "uuid": "34e81297-ef0c-4a0b-8bab-5fc3c8bdea06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872845, "uuid": "46d26f07-6a94-4a4a-923b-78c027c52231", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84da3422-a7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675880537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880537, "uuid": "3dc03382-a68b-4519-ab04-b442252f2bb8", "comment": "Malware payload (Guildma)", "value": "e2c30167f18721a78a129b6e3fc65a58", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880537, "uuid": "7bfb8004-5c30-4331-8330-f9ad8b968706", "comment": "Malware payload (Guildma)", "value": "891c0f278b1e6005266746500a34fcf6d7783dadc434607931e22c7a6b25a2a1", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880537, "uuid": "026b0fa0-3b07-4912-a512-6eabb3039ddb", "comment": "Malware payload (Guildma)", "value": "f508c82c5223993bef3d5c391c0c192a1a4de5af", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880537, "uuid": "6e78593c-e6ed-43f3-8ee3-8d4108ae730d", "comment": "Malware payload (Guildma)", "value": "9a3ed49ebc3c27ac6e6bf4001648397f9499ee74e2b2c6897274595746ed2461012c1aab995036638fa5c70058beb2bc", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880537, "uuid": "63590d86-82f8-4299-927e-d853b5dff704", "value": "T1E1F0F14E73711EC9F8382632CD1D07400F2C3E070F4D23626B5D05D449A1B88DD0D1A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880537, "uuid": "fb0658c5-182f-4d38-982e-aaffd7cd299a", "value": "12:8rflM8OBE6ZG8WgkZu+jd4L6WOmUFm71/mAUPLKBwdpTNU0:8loG8WFZBOLlOHm78jLKBkNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880537, "uuid": "c2d6d576-b174-4715-bff0-76fae3bd9c92", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880537, "uuid": "d4fba9c0-bf1e-4817-b861-4c969bb4dade", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880537, "uuid": "2483d6ea-d15f-4023-8d6d-9d59667d272c", "value": "05631528_438.49004813.893302.59321.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1562028e-a7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675872190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872190, "uuid": "d71afb81-625d-4332-a3f1-b4639f812886", "comment": "Malware payload (GCleaner)", "value": "288ad987c9213c18efd24cfb7829621d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872190, "uuid": "b91ed8d2-eb84-4b0b-a797-197323ecfbca", "comment": "Malware payload (GCleaner)", "value": "89563b3d062c9fda42e2519d0249d3a27d1b186fc68278d241b8621cf70ad8f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872190, "uuid": "d21aee5c-256e-403d-bfad-5dd612e368a0", "comment": "Malware payload (GCleaner)", "value": "795eefe4135fe881f87d5afc5eb779d8a7ab3d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872190, "uuid": "4c3f9e2b-98c3-4256-84b9-b832e179cf5f", "comment": "Malware payload (GCleaner)", "value": "9e105d87cb6f1385d1728b66d50f847d3258bb2e1e1da6b0bf9b11c92011fb4f9cf3f7516c19f01ced71097426aa993c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872190, "uuid": "08387295-5ee8-4390-84eb-ea14c36c5aaf", "value": "T1A5C5127DB505C9ADC280BEB48D2A94F34CD66DE3E8D4A46270DD7F3F41B91898B0A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872190, "uuid": "8296d307-c0b6-45c1-9f2f-e5b6c6d20b11", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872190, "uuid": "11a67b7c-7e96-4a29-b921-15022c6bf80b", "value": "49152:rdH1u5fUFjSna2SWqxmxmGwf0Mi8j+HAyzkRKRnS95mZgn62dvnsLCgv2MR:JH1OOjSn1fygTYJ95mMqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872190, "uuid": "8058fe14-5bc4-497f-b362-8acdc457f7e4", "value": 2732535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872190, "uuid": "9629e528-1067-4ecb-afcf-f01858939405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872190, "uuid": "996e1789-80e2-40b2-8e30-71bdffefbe01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443ad74e-a765-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675828889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828889, "uuid": "8951558d-b243-484c-b2ac-aa611db12691", "comment": "Malware payload (Amadey)", "value": "1e8af855201d0cfb9916506fd3ff10e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828889, "uuid": "b1f743fe-e4cf-4a22-bb31-ceb7b1ffbab9", "comment": "Malware payload (Amadey)", "value": "89606cde8cf74cd5f87d69a555ee05296c78f86f77b1068aa8e84d736beff0ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828889, "uuid": "6008008d-73c5-4d06-837f-486b46f756bf", "comment": "Malware payload (Amadey)", "value": "ff551e1a2c16985a94f0ebb0424f9ac38c01e653", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828889, "uuid": "2e547300-6e3f-4e2c-8af8-31524b7bcef1", "comment": "Malware payload (Amadey)", "value": "4f2f31e7f77a95f57cb077497c9485dccb111ad3eb993bf9af6ac5629da5b30f592574dbb2db75a588fe4d1da8505a4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828889, "uuid": "c20d6a8d-273f-4d59-a09b-728284e4d6aa", "value": "T132B40207FAFD9422D8B59BB018F706C30A367EA0577883A7378F6D5A1C72565A230367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828889, "uuid": "c08e658f-1666-4bb0-be77-bb27fc6e6f03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828889, "uuid": "15a5defa-5242-4512-9082-e81b16a1846e", "value": "6144:Kjy+bnr+5p0yN90QEqfLnfNVsVXo+KKuBv8m+8fGVvMCZc11YyguW1oNLnD8wOjD:VMrVy90enfbsVsLvTuECLuAopowOOO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675828889, "uuid": "62697f3d-dc4e-452a-97bc-47fdf87dcc22", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675828889, "uuid": "5ccd1824-6b49-4a13-95bc-86860ee5275c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828889, "uuid": "910c43a7-e290-41c4-828d-d4e67c2a2d15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76723583-a789-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675844435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844435, "uuid": "08cb1fba-becc-4afa-bbf1-fac02db23713", "comment": "Malware payload (AgentTesla)", "value": "7f4c004f3d40d34dbfbc3952add060ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844435, "uuid": "76d9bb40-70a4-4d8b-bc5e-6a5a8ed29673", "comment": "Malware payload (AgentTesla)", "value": "896867ba250cf2f64c9b41d1869d245fffaf710091819a45eb9be731a39a9647", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844435, "uuid": "37d0ed99-f5e2-4ef3-900b-a95fd67dfd40", "comment": "Malware payload (AgentTesla)", "value": "3a61e75d92c57fb2d42007da720518454402ba57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844435, "uuid": "815d70ab-bf7c-4a00-9fa8-216bd0c1fe14", "comment": "Malware payload (AgentTesla)", "value": "661d4322006c1812d8297c4325c10d5789def7d0aa9da3634938a60045290879d721f127ccb7319aadb2ded4e4fb1d83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844435, "uuid": "04b99b9c-0da5-49dc-ae85-15638ef326a4", "value": "T19535283A297A67D2D038FA7546E04460B2EC9F97B303C859BCE13AC0DF815856ECB65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844435, "uuid": "8eeafd30-05ca-4670-8f84-6d79bbc987f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844435, "uuid": "ffd11465-3b5b-4653-a6da-789bbf98d62f", "value": "24576:RTm1dhhBL7MTyPdLX2tuCAe/ZXQOxltKHajWR1yqOeM3gnEmxTgGJxOkQmoS6:5m1dhhtKIy01yI2mV3JxOkQmoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844435, "uuid": "59d12bc0-bffb-401c-aa6e-e198c89c3319", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844435, "uuid": "ce78b231-4579-49cb-9680-d2348a6b3ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844435, "uuid": "a808400a-97b3-49cb-a145-493185ece7c1", "value": "PO 409730-273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6d9704-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880897, "uuid": "f482b6d6-9fc8-46d9-acd0-643216aad2f4", "comment": "Malware payload (SnakeKeylogger)", "value": "9d82fe5160b573f7ac92c0c9e660f718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880897, "uuid": "93b86a23-d43d-4696-a9b4-fd87a1818ce3", "comment": "Malware payload (SnakeKeylogger)", "value": "899c55fd37dfbebb162f969ac3ec57ce8577c122c7dc49842ef77fc99dc9b650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880897, "uuid": "25de1391-1e09-4657-b3d3-e7a120f1e26e", "comment": "Malware payload (SnakeKeylogger)", "value": "ab9ff87a94a87840655cea0bffb3b4c624b0d483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880897, "uuid": "a015829b-2767-46d5-99a3-1bf3330e2be5", "comment": "Malware payload (SnakeKeylogger)", "value": "3e536d71d61dd4803bf0ea0c4e6243cc593fd2b59d0d41ffffe6dbb14bb7690f6fcd94b0649d8de1b9de747b55b089ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880897, "uuid": "0ff90498-d41f-4e93-8cd5-5f0e2ca99258", "value": "T106B401A83464C8CFE49E1B714E65FA3A1720BC702C8C9D873E6A3F5DB9B1245241D7E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880897, "uuid": "6c171f1d-823c-4232-ae8e-e7168133d276", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880897, "uuid": "83d7eecb-3b51-4ee7-8e96-9917237eaa3c", "value": "12288:OYsMTy/BU/w92KePmC6zStFWmgW0PlEoC5Z0:OYdTysw92KdC6ubW/XPlEoCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880897, "uuid": "32ae7f0a-c728-4b01-b692-91ebd75b4201", "value": 512059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880897, "uuid": "a0c9c266-cfc5-4589-be75-6aaee4cf3dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880897, "uuid": "e7e8b1b7-1480-4f1b-9c98-8c0600e99856", "value": "QUOTE H2100131418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f8a49d-a75a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1675824221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824221, "uuid": "110fdebd-14af-41d2-af52-3884878ee6c9", "comment": "Malware payload (RustyStealer)", "value": "e47135ab052f388940218ea52a0b5b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824221, "uuid": "4a00db45-9456-48fd-ba4c-966bc4c2e2c3", "comment": "Malware payload (RustyStealer)", "value": "8a0d6d5c1f8a752b477f097642672f8adb31b34b4c0b83720dfd0669d3944ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824221, "uuid": "94796643-8a0d-423f-92e0-3c91d1715259", "comment": "Malware payload (RustyStealer)", "value": "fa905510a9251834dbf831e834d0f8493325087c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824221, "uuid": "d04dd3ca-fba8-4a25-9559-92721f6a51fc", "comment": "Malware payload (RustyStealer)", "value": "df096de9a88beb01af27f290fa32f6e752eab5171fb783cc3a5dd3101cbfb15a45328a6ab0054edda3984a44316303f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824221, "uuid": "86bb006c-f4da-40f4-a54b-c940a174e6d3", "value": "T1E1F54A03E34985AEC06FC278C7565736FA31BCCA4324BB6F1AD46B317D66B605B1E608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824221, "uuid": "e7ccbe33-bf76-44d8-86db-3cf396e3aa49", "value": "c5ad9f35cb363eda905e3e4aa2a6ec98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824221, "uuid": "74015a0a-5e6f-4713-9169-71932cca5561", "value": "49152:MS4PgDvSzu2Prr5FsU4Yod86ZJniJhoEV+MslTQg0IEiHWvoH8KdFu6cxEMfAXp0:r4PYe5CUo4vUvOmGyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675824221, "uuid": "91e324f5-9646-4a6b-aeed-9c471a2c4c27", "value": 3507712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675824221, "uuid": "8080b9d5-a06b-437b-ae43-031c21f25f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824221, "uuid": "1f65f45b-f160-4543-bd40-7d7a1b7272a9", "value": "Oxzy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461fbf04-a7ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886015, "uuid": "5b659235-ea77-470f-af76-f3e975f040a7", "comment": "Malware payload", "value": "8e9edf397bdf50df853f59e0cd3f7408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886015, "uuid": "86b4ea19-6c88-4cb1-a351-f0b9bdf66248", "comment": "Malware payload", "value": "8a3853b21d693c69be0e1b819e79c110d1277b362d2b0b7622e5244cb5664092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886015, "uuid": "adccaa95-437c-4700-ae2f-5dc22525cb88", "comment": "Malware payload", "value": "a9313595c86d094eb5e3efd7a0489158ff3c0e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886015, "uuid": "e5e53217-d9bc-4710-bf03-fcb6a386ae5d", "comment": "Malware payload", "value": "0fc3f803ac8381202f05714e06517efede0643774aa93d9c1d086bd3b90eff0ba608b2459df5cf16a2b15e6f8522f2ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886015, "uuid": "267e8fe3-d98d-4a65-b435-12d170f920d6", "value": "T135C40147F3EE9023E5B51B3068F703C71936B9715F34836A128FAC551EB2264A631B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886015, "uuid": "ac4f051c-b36b-43e2-874f-ba495275fbd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886015, "uuid": "86b1bcd0-9e96-40b9-be15-4202050aefc9", "value": "12288:AMrNy90HaMFVjS+vksrM/AD4827M6kWOMr/+rHo4WFsx8:dyyVm+ssrQAc82DLlr/ahYsx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886015, "uuid": "597fef1a-6e82-4541-a3da-01797fae746e", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886015, "uuid": "f76b3a15-c1fa-486d-bc5c-3536684543c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886015, "uuid": "004f45d6-36e7-40a0-b315-dcdc4c687495", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889c3199-a7b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675864223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864223, "uuid": "fc63533b-66a6-4461-b2e6-02c9a92fe4ae", "comment": "Malware payload (Amadey)", "value": "bd799d482cbe84c30e9d21033696dcdf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864223, "uuid": "80a72868-1491-4020-b6c8-b6066ba757b7", "comment": "Malware payload (Amadey)", "value": "8a5cfe2761febb6884c8c44bd294a305dceb1572872e7defeb020b3c0c4cfc0b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864223, "uuid": "5f093bc4-d519-44ec-8827-4b94623979c1", "comment": "Malware payload (Amadey)", "value": "f4aa250ba0b4d29d8f62eb5c93b6f3a9453e5436", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864223, "uuid": "c7857e98-7ab3-4165-b336-44e725737610", "comment": "Malware payload (Amadey)", "value": "5f81fdd3c2c735f228f3ed15ee3ed7c7b6f0416767b1550501de683e0d27822ad9c6532a2f38e7c42b4305f10e819613", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864223, "uuid": "c2053eb1-b483-48ef-ada1-c1b3fb66d3cb", "value": "T136C41207F7E98072D8B5577028F503D31A367EE05A3A875B274EAD5A1C725B09A3233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864223, "uuid": "621c66ee-6874-4e60-9708-bca946c85587", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864223, "uuid": "8b0d889b-9328-401a-afab-8094643863b2", "value": "12288:2Mryy90DswOgo7hmk564KEarSaGsm0MGTuwLYHG2ifR2Dj:EypPgu356SdaGsm0/C6OGDWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675864223, "uuid": "22af196d-8b1a-4396-a340-8038c8d5262d", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675864223, "uuid": "e5b0414a-e8b2-4d6b-9564-be427a397267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864223, "uuid": "c5125dfe-5ee7-42f0-873e-a287a591bcf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56798059-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675819900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819900, "uuid": "130ea602-0cc4-45e7-9dee-86b93ff9b82a", "comment": "Malware payload (AgentTesla)", "value": "5e3c0b08904d967d151047a51ca76cc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819900, "uuid": "2e7046bd-ffcc-4897-86e8-3601f5a1db60", "comment": "Malware payload (AgentTesla)", "value": "8aba0e5b9847ec754c70691ce5b2ebe888ea4d3599a3fd7d6b431603ba2d77ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819900, "uuid": "e5d3dfc1-8068-4139-99fd-a1dbb639bd11", "comment": "Malware payload (AgentTesla)", "value": "6b7893406f444e7132fec10633c9aa63413d3b1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819900, "uuid": "ccc9d3da-02d4-4038-852f-b526d92ac502", "comment": "Malware payload (AgentTesla)", "value": "a99b9a37881100f32ce6bf63892c5b03ef143585d60f1efc9962a0abf4c6a890af9c50a9cb51ae7b9019ae9490d1bafa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819900, "uuid": "a8eda4c4-b1a1-48d6-8667-77c50a0b3f45", "value": "T16BF4E0437A40B7E1D8B444392C0AC1F70B956E399A053E5B3AD4BF3F38B6123964976A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819900, "uuid": "584140aa-1bf7-4806-8871-ccedf1d1fc59", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819900, "uuid": "3267e887-9b85-41b5-9cdc-29ac531d4f23", "value": "6144:cYa6uW0O0WqiBiGei7FTjUosytWnSS1SqYXtbVMXGzcA+KDOTLf2EYs1/rnDVDPv:cYWWqyTTVNVMWzzhAKEL/DpLnFyoLFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819900, "uuid": "ac2b4c80-cc0e-4120-af8c-abbde42cf886", "value": 724389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819900, "uuid": "881541e5-b21d-4559-a9ca-f8b657e5ea51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819900, "uuid": "9fb77408-294c-4e0f-8574-4aafcb2639c6", "value": "5e3c0b08904d967d151047a51ca76cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec661e7-a7b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675863213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863213, "uuid": "1d9efde3-57cb-4b15-9053-a5ae1fe7cf92", "comment": "Malware payload (Amadey)", "value": "6ea6ff7d4835a51514d571aa974c39ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863213, "uuid": "2df1f23a-d73b-404d-8b03-103e29367e53", "comment": "Malware payload (Amadey)", "value": "8b8f151a0b3c988e41abe8b301195622451deae978b3aba80ca9a4e16817b810", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863213, "uuid": "6a2d9817-e8b5-4503-b7fb-31291b943748", "comment": "Malware payload (Amadey)", "value": "3ab2b56a5295cbc6cc6b529494f6d95da130b40a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863213, "uuid": "489a0b31-76c4-4233-b736-e5ef8b269c18", "comment": "Malware payload (Amadey)", "value": "fd43aedb747e48ee4af72c8ba08f1d74a6444a24d83c02624611f70801fdc6309bb36b241f675ff2caaf720984886900", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863213, "uuid": "4c9cd5bc-38d7-4c1b-88b9-75d908ca19fd", "value": "T123C4010BFBE98036E8B49B7429F602C30A367EA11A39476B174F6D560C325B5E171377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863213, "uuid": "93250b42-5a84-4684-ae1c-41cf851f1fa8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863213, "uuid": "2668019d-eb84-4bdc-a9b1-448c55587a12", "value": "12288:KMrBy905MIl6SVXDN0m/Lja64KEarSa8em8MGWaCyWT5OD:zy8htVx0+Lja66da8em8/TWT5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863213, "uuid": "8c06f246-43ba-4bcf-9b8e-aad10014c81e", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863213, "uuid": "0519dfa0-359f-437f-a6f1-55559381e7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863213, "uuid": "6e2c785f-6529-49fc-904d-7798fa0cd6bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f43904d-a761-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675827217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827217, "uuid": "573490a8-db16-4945-8c58-2f957fd7e13b", "comment": "Malware payload (Amadey)", "value": "89e64257cf1e2854f52191677a169c98", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827217, "uuid": "fee2becb-2b3a-497f-87b9-b4bb03753de9", "comment": "Malware payload (Amadey)", "value": "8c41bec10d3f23b17a42b357ee1fb456084571dc35bb65aeab907d7d5030aeac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827217, "uuid": "74ed6fd2-1fb1-4497-8b31-f3564e18905c", "comment": "Malware payload (Amadey)", "value": "cb5ad1a04abfc28f40a79d819bb4bb7945fe5e2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827217, "uuid": "91925dc9-4e0e-4fcf-ad91-e8aae4d89a8f", "comment": "Malware payload (Amadey)", "value": "0eec4fffe08e3592412795d4cbde07585f89811b807ff63d4e6c1ae4400a2d5e9fbcf1545fb6d7e5bedac56efb0bc9b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827217, "uuid": "6c0e875d-eabf-4ac1-a17a-a62d3d4571bb", "value": "T1EFB40217EBEC5036D4B8577009F303D30A367EA18B34974B274EA95E0972AA4B1B573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827217, "uuid": "9bc81d1d-2d7c-4b89-a809-74b6a56633a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827217, "uuid": "3f85c481-e8b9-4c24-af5a-2663b869dbda", "value": "12288:iMrEy90ZvZtSBUJrf0WLfcY64mcfnBhKAAmII:qyghOUJwWL44mshKGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675827217, "uuid": "27123ab8-b5fc-4072-a2c3-4f094d130815", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675827217, "uuid": "184b78fb-90f9-4741-9ef9-3846e43d95f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827217, "uuid": "047cbff1-67a0-4738-a5b7-bff336c14308", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c7e220-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855871, "uuid": "647d3d9e-9d58-42ce-b379-c60faab7db4a", "comment": "Malware payload (AgentTesla)", "value": "e39802aa0c1ec2ac729b7d0cef976fde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855871, "uuid": "750591dd-39e4-4942-90c1-299f96500751", "comment": "Malware payload (AgentTesla)", "value": "8c502620c4b378b6fec3cc2abed90dd0d475d18fa33c34b0a8187e9b00ef13f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855871, "uuid": "3caa463a-6add-4d28-975f-abda33ccbef8", "comment": "Malware payload (AgentTesla)", "value": "89df1e4eee88f0ac5ad17f13a0a8e4adde1ba1ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855871, "uuid": "0c637c0f-77b5-436e-900a-aafa33e9687b", "comment": "Malware payload (AgentTesla)", "value": "a75deee6c7e86ac4a51a43bba74c5d9e81aa5ef4634dc3a4ac7ce492cb6ed8bcfad6530744a11094d51161ce36e38d30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855871, "uuid": "bbf7231c-740a-4690-8c3d-c2f16fb714d3", "value": "T1BFD26C15B6EC5733E93A53F488E6255507F5B5435002EBAA1DC6A0CF8AE3B900721ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855871, "uuid": "587dbba0-e8fc-4fc3-8643-a37faba2d57f", "value": "384:RjzCUGYvAnp0Cu+SQCTtluRCYNg2nQ+Mg5KlEhrrOANb4+oPNeckRqVmHOjvcr9g:RfCUhXwRCY2t+xJ5rVSRkRKjeOC7WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855871, "uuid": "a9fd8c80-3806-43df-b1f4-4e5231ceaca9", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855871, "uuid": "fdb7a4d9-a9cc-4dfd-9d47-2b63855aeeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855871, "uuid": "e08032e4-d962-4a4b-9151-36b19a81ce3f", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b122eb-a7e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675884030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884030, "uuid": "481dd977-3755-48af-b3e9-16d525fe81c3", "comment": "Malware payload (Loki)", "value": "b9d2a12dec8e6f3d7a5260c6259aa639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884030, "uuid": "daf1868a-d6f5-4571-9e47-147711a14e7e", "comment": "Malware payload (Loki)", "value": "8c61d61c9162a6735ceb53e4109851feacfb05f2dee42ead799680cf874ec903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884030, "uuid": "adddca21-6a48-421d-83e2-83d442912c31", "comment": "Malware payload (Loki)", "value": "3c5fd96f26116d68c46219c15e04b56916f312b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884030, "uuid": "99d8c12f-f0e8-498f-a311-ec5727677ae8", "comment": "Malware payload (Loki)", "value": "0bb023ad6b6768dcd7e28dae0ae852fea9b60249f4c339621cd63c4af8d366b4226cb9e05abd6840045f310fe86c5d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884030, "uuid": "4c23fcb3-b26d-4d7d-858c-2c86cc5f8a97", "value": "T136644C5393D27C48ED258B33EE1EC6E8F60DF590FE4A7B693219AA1F1870172C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884030, "uuid": "4410f915-a8d1-4649-b19d-e2304e2840e4", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884030, "uuid": "56074229-28f6-4b0e-af2a-f94d20672b45", "value": "3072:Owrqo6l/yXR5b71vA1YUnIxNjPJwaPAj51QtmhDlLnWByUAl16CXiE+iBW:Om++HdAvnIxNagAbfDRnWUj6FiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675884030, "uuid": "a924c13a-a5ee-4700-9f96-2ab91659a62e", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675884030, "uuid": "01d63e20-78dd-4f4e-a93f-1c9805756aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884030, "uuid": "9a8f3073-8505-4ed0-88d1-c3d010a90f02", "value": "b9d2a12dec8e6f3d7a5260c6259aa639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365d175d-a77c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675838744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838744, "uuid": "72210b84-4732-48ce-b18c-19d643457365", "comment": "Malware payload (GuLoader)", "value": "ea53f3229f67243547d0d0ee6ee9736b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838744, "uuid": "352f3a36-63da-4200-82d3-3d5e271d25f8", "comment": "Malware payload (GuLoader)", "value": "8c8100eb58a4574f472f2cd856b09a13e6f4fc03a65cb82e6559eaebdfd34b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838744, "uuid": "ccd87551-9372-43e4-93f1-7b970e8f1abe", "comment": "Malware payload (GuLoader)", "value": "41c0f5b2cc28f3865b12ec88bfad099d1443e14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838744, "uuid": "2c3418e8-1bfb-45ce-945e-81a5200a12c2", "comment": "Malware payload (GuLoader)", "value": "ab5804cc7607d299138e63a2538cc7348078eff459818c1b7f344bba9b17ab384cbda5a9808686b7067b7b3928fe846a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838744, "uuid": "16e2627b-38da-497d-8a6a-e0915f232fba", "value": "T170F4BF5272348B8BC11753B44D23E77991141EECADA1C39931B67E2FB8B2A534E236DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838744, "uuid": "b283d1c4-f89d-4d34-bcd0-42ef391217eb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838744, "uuid": "e46ca96a-087f-499e-8abf-4d149f8d447d", "value": "12288:W2cL2HkGchuWXqm77rY7Hi31T8jAYyk/0pT0+:WncckWX7774QT2AYbI0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838744, "uuid": "ef9f4e1f-f6fc-4d48-ba1b-8b9359abf0c8", "value": 728800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838744, "uuid": "cc175b7f-b39a-4238-8272-410427fff782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838744, "uuid": "7cdc0c3f-c364-48e6-8ed3-8a439cab0181", "value": "Dobbeltlberne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9383af1-a7a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675854855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854855, "uuid": "51884f54-cd36-45dc-b621-38a6d2140320", "comment": "Malware payload (Amadey)", "value": "66fd219fc2be67a7329c1106f949e055", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854855, "uuid": "695f7d55-f7cf-4818-951a-e95d5a7b9370", "comment": "Malware payload (Amadey)", "value": "8c910ec77f411c92c3ed3d044e692f1ca4f8bd296a49a3b97b4d4b1da664d805", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854855, "uuid": "ce4483a4-b21f-4708-b67d-a7e9f292cf5a", "comment": "Malware payload (Amadey)", "value": "eba4fe18fe198d53a5393cfa06e883d2cc65eb99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854855, "uuid": "94365087-252c-45db-abea-1583975aebbb", "comment": "Malware payload (Amadey)", "value": "ee93b256335f6f659f7ec226f24a9c2f758cd2e9cc5ae67b32585a2a00b89d59dacf83b5134888e4e683bfddafc36bb0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854855, "uuid": "036e1c71-a5df-4124-916e-ad794693035e", "value": "T131C4021BF6FC8462D8B0577019F603D31636BEA10A3C83DB238A6D5A1C726D1A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854855, "uuid": "614e0778-91ab-4a60-b43f-d6c88d7885f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854855, "uuid": "7b6fe635-5ae9-4391-8f8a-8d665cb660d3", "value": "12288:+MrDy90MmMBH3j0vOn0OKdvhK2NYBzblZOxMI:lywI0S0OgpK22ZlZcMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854855, "uuid": "518b9472-d88a-4709-9b0f-c3024ad09aca", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854855, "uuid": "5bbe5dbd-864b-4e51-b0be-e7ef9066d5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854855, "uuid": "f96ba631-f148-4a95-8318-564fd08d654a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ebefba-a74a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675817274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817274, "uuid": "502c558d-092d-41b2-a7a3-22f8a8b33d59", "comment": "Malware payload", "value": "f768496aa27753e5a6fedfb29251b2b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817274, "uuid": "493cdbe4-f5a5-4cc1-b114-cbfc1dd35034", "comment": "Malware payload", "value": "8cbf5c2e2b5965c0a90503b886431a20ba206350303dff157422acc9212facf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817274, "uuid": "dffb2786-38f4-48f3-820d-8061df91105d", "comment": "Malware payload", "value": "cf7a0fd24dbfb49861e2a2a165b48cc7f0152b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817274, "uuid": "6f66e625-2b0b-44e5-9de6-0faa4ac29a34", "comment": "Malware payload", "value": "bb981a395533020d5a2d809445a14b14c96a09e0761c85758c1b6a31d8e4d0a9943da7dab03479e7b56e0174a503aeeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817274, "uuid": "40cb98f8-c5b0-480e-a078-ceea79b23fa0", "value": "T1EF763312BCD7CE75E541447288315FC192EBC3382E650AB34B7E076EBEBDAC8C51925A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817274, "uuid": "ce031576-ad4f-4481-b14c-4be3a560b691", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817274, "uuid": "5b92a73a-60b4-4286-a27b-56261eaceff3", "value": "196608:91OwGz8kd77/zbBIPBiUwL9+ethjXyhduxl6plS1RnDffQfDa:3Owxkd7rzbUqh7yhkwQ1RzQfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817274, "uuid": "666c54eb-5ee9-45da-8edd-313fd94b91b9", "value": 7596423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817274, "uuid": "43a7b4c4-ccd6-4362-905a-0041da18eb31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817274, "uuid": "b5513f92-fb24-4014-842e-5545b3afea56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d16eaff-a7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675855587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855587, "uuid": "0acbed24-9e6d-4f22-9aed-eb1c747288ce", "comment": "Malware payload (RedLineStealer)", "value": "27ffa91c49dc11aad10a7725654d79c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855587, "uuid": "e3381755-e6fa-46ea-a1d0-602502ac9b00", "comment": "Malware payload (RedLineStealer)", "value": "8cec20ab263ef2d9965708bb2d57473782cb998dfc2578e3d14de167578dc0a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855587, "uuid": "4011eae7-dcd4-43bb-b51b-2e7aa7a761c2", "comment": "Malware payload (RedLineStealer)", "value": "19dbb14618c3c85e3e49e5ecb31af84614d55f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855587, "uuid": "e61d4c02-cd71-4231-adc5-1dbf1d32f94d", "comment": "Malware payload (RedLineStealer)", "value": "e122c3f9a103bfc9abf2ec7b1a189fd636e05c91496b1e2e6b28e82d9641e61fa1239149b4b3a83831d5bd3b2d281254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855587, "uuid": "888cceaf-628a-4a51-a961-df472261dceb", "value": "T1DAC4020BF7EC8533E9B153B10AFA03C316377D611B34929B268A7D4E18B16A1B931767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855587, "uuid": "b6635f9e-a379-47f8-8e09-c8b10747afa4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855587, "uuid": "035b21a9-01ee-46ad-a827-d3ea8ded624f", "value": "6144:KRy+bnr+Np0yN90QETqTbCaf4H9pq2mx+URzww3WlDxCqtgzIjt3Lze9hOi2Di9A:vMrhy9024dpDm1wkoCSdMhn2oYmCd02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855587, "uuid": "ebbc61e4-24e3-4ae5-8403-8364f4fcae63", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855587, "uuid": "a769d23a-5b18-41a6-bbe9-c50b8fae5ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855587, "uuid": "97ea2368-ae66-4022-b443-80ec298dc995", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1c53ea-a7b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675864957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864957, "uuid": "ceaf0e16-ae13-4640-9ca6-83e7c6c00cc5", "comment": "Malware payload (Amadey)", "value": "24e84bffa6f58c329655a0b74bf0b1df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864957, "uuid": "d94fa9ec-bedc-4919-9cc8-d420b8fc197c", "comment": "Malware payload (Amadey)", "value": "8d379cb30d026485777e6e25ed309ea3ac62bb4e32a385b4e255625be500c111", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864957, "uuid": "99c8bd93-5bb7-4898-a2f7-48cea5d8ccef", "comment": "Malware payload (Amadey)", "value": "f600a4eb19efa964dbbe70e1d42b388dac79dcce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675864957, "uuid": "f49eb9d6-5177-40ef-967d-b2c56699a11a", "comment": "Malware payload (Amadey)", "value": "4992d25cf3b10ede1637be8a99b28bfc2525af85f05892d590510b78820d37e9686258c43ed414c6f9de8b52ff4f4124", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864957, "uuid": "ee4fe8b1-5f1c-4a17-b8b2-badc1acb7918", "value": "T1CEC41217FBE84072E9F48B701DF602C309367EA16A7857AB6B4EAD5A1C31574A13133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864957, "uuid": "7ddb98f6-91e0-42e7-bc4f-fbc4436757b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864957, "uuid": "c1addd78-e07f-49b3-a895-0a3e5acd74e3", "value": "12288:XMr1y90/jjITZx79pyYo8MNAJ+64wEarSa4amaMGETY5NSL:yygITZx7Y8Uj6Sda4ama/EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675864957, "uuid": "281ab134-e99b-48a6-9e00-b43f72640cff", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675864957, "uuid": "c6c2d14b-d9bf-4655-81d1-ab5cddf8f5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675864957, "uuid": "9da641cf-2ba6-4aee-8759-b71c11eafe25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4a7418-a7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675875562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875562, "uuid": "34a343fb-4342-429c-a1e1-750af219af8a", "comment": "Malware payload", "value": "f8038c14b1459ec36132ef982f9adda8", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875562, "uuid": "5f2a2fbd-f9bd-419e-9d85-2f1e2837740e", "comment": "Malware payload", "value": "8e373da9b6afb1ba23a8e8ee2c34a13e0e23a2a48263a38d9fbb4a928bdbace8", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875562, "uuid": "a5d886db-3e4f-4b0d-9095-10c110981b40", "comment": "Malware payload", "value": "9d2739b0dbec1a5a25a2fb19d1775345363d0615", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875562, "uuid": "4737473e-1e1a-4dac-8639-448bb75dabeb", "comment": "Malware payload", "value": "07cba04b5781595dc5aed87c38622e092357c4367918c51e0be6beebf942720f1971123d578d0883f2ad528da77c8716", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875562, "uuid": "ab8880a7-cd4e-4740-8aa0-a2ffe3212b74", "value": "T13C11DDF61B2E9013C5B5CB521D4B925ECF6041A1A8C40A01F8FE4E70DF3A122A35FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875562, "uuid": "f9ef1f12-8e40-4e37-8aa8-9e84509ffb06", "value": "24:DOVtyCiuXdeXQsFTxnswvpdPNuR71q2z8JAh/:DOVtyCiYTsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875562, "uuid": "0b770abf-b560-4fe1-ab95-fb60c2c7db5d", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875562, "uuid": "e20fe568-de7e-4c74-9e84-6c67eb2cefc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875562, "uuid": "e071b89d-0eed-42ee-af89-52a68c28463e", "value": "Nz97PyJr.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93cfe74-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675881484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881484, "uuid": "78518031-2cdd-4642-bcd1-e2fd1ad1f17d", "comment": "Malware payload (Loki)", "value": "c08915d718c9b1da8400751f213e7bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881484, "uuid": "dd63bacd-392b-4920-a4e3-93dd5fbc7126", "comment": "Malware payload (Loki)", "value": "8e50298bbba73d4b92ffa37dba5a5807c34d248600b72238d4fcb9ae55c3ce0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881484, "uuid": "ae8fd730-9c40-4c90-9642-4b12e16dc18c", "comment": "Malware payload (Loki)", "value": "439bf8130c4473cbe1a1080c4164835d5c8caad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881484, "uuid": "50528b72-e1e4-46e6-9e3a-498d8bbb27f4", "comment": "Malware payload (Loki)", "value": "21e78b87c62923773657b546d46de4c4e2d3d05f9ba8f59cd5b2f29b8767f7e397978ad78cabcd1d881167019b34b6ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881484, "uuid": "8dd7d2fc-30a1-48fe-ad74-de493cace9ac", "value": "T1BF749CDAC2405890ED966F7A21339D3A91677E7DBCB8A60D2ADC7A333B736C30425543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881484, "uuid": "29c33aa2-3cdc-4887-a703-2fb311c0bd5a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881484, "uuid": "e7d3c388-d236-4baa-8aa2-2ec708154cc4", "value": "6144:uYa6oFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFQ:uYi//tP/RMHzeSU77QGTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881484, "uuid": "73ae2008-197a-4d8d-b2a8-4706856ea704", "value": 353903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881484, "uuid": "c5247d2e-2d77-4c96-bf71-5522ec772d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881484, "uuid": "49ab6439-a5da-49b1-a8b2-f3d8348caf9e", "value": "HSBC Advise_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6785be-a749-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675817036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817036, "uuid": "cf2721e0-6027-4d90-8e86-1d6fe8df6c2b", "comment": "Malware payload (RemcosRAT)", "value": "d33852151bd28a38824c6269a051c818", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817036, "uuid": "fcc2d60c-c9db-4de8-87cd-a2fe3f42186f", "comment": "Malware payload (RemcosRAT)", "value": "8f35ae02b5ba88554c9d41fb1cd9aaa916a8136fa8d442dcc894ac46f593d7c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817036, "uuid": "7d0275fa-8a8e-4dad-8b40-370df8726e9d", "comment": "Malware payload (RemcosRAT)", "value": "7501a498fdec9ba90538b1907fa1222afeecc6d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675817036, "uuid": "0f4a14d9-2692-4ab0-9406-0ed13482b50e", "comment": "Malware payload (RemcosRAT)", "value": "75dbde31a25e347d063f3b7fda85aa6191562c1bab772c0752d203f5c052bfc4572549c46b7efe459a728a173de53fc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817036, "uuid": "7446c3d9-9376-4750-9756-d85e7916622f", "value": "T13D35230E6FF9DB31C9586BB818306C60037EAC297122F32D1D96B1DB6C3BB545611AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817036, "uuid": "9cdddbe9-ed4e-40bb-b4ce-4f4ce97d21ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817036, "uuid": "07453a72-1df0-478f-8f94-eb30f458f538", "value": "24576:3Q7OkPkU7TooG8uXJmGHTxsg01Q6w3FVTANfUrn+WawxO5dmZ:A7pk6T9G8uIGzx01SVTAR0TsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675817036, "uuid": "0907940c-7e32-4fcd-91ba-c56d43b62e3d", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675817036, "uuid": "d34993b9-cf70-4cbe-b7c2-b3b30378f4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675817036, "uuid": "5bc1f029-d5d9-434f-9010-4dce620d7944", "value": "d33852151bd28a38824c6269a051c818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77997b1-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675847175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847175, "uuid": "4c52a404-3ffc-4223-95b9-5c6cd9ab18b1", "comment": "Malware payload", "value": "b3db40facf71de90310f1ea0e961f085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847175, "uuid": "c4be28ac-d307-4e57-9e13-010b11043d71", "comment": "Malware payload", "value": "8f361a42ce0569f79f614640002662e53de70276c8438cfb8163a4c3ceb6bd23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847175, "uuid": "d9d65775-b73e-4550-a567-fa66b276c8a6", "comment": "Malware payload", "value": "222de8f9abf274aa2853447a0ff39e7c0ab6bace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847175, "uuid": "ad37d4bd-230c-4511-994c-98521e1c267d", "comment": "Malware payload", "value": "fe133558b97eb3c8ea440ef088c29bdc99c065cde05bb23e702de85d530d278bf1737a51a0063a150f6cea40bf88f8e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847175, "uuid": "efffb4e7-2875-4b4b-a797-9f5355945477", "value": "T1C57633B136D181FECB505A31EF34BE26E1E5E0452E61CCA72B05532C3EF6C85A16DBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847175, "uuid": "ad12c03f-5b5b-411d-b768-f4d43f2ab820", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847175, "uuid": "5678444a-082a-4e8d-9821-741381b31941", "value": "196608:91O3PrBdbhDUWPNM5uNZCd7FSbSbFNn4o1c9tibO3z:3OfrhDUiM8Od7FSbSbFNnoiij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675847175, "uuid": "0f4915cd-edca-432b-8ac4-22324d87055f", "value": 7610271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675847175, "uuid": "21b0c402-46da-4f31-bed8-9410eed507f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847175, "uuid": "330f6184-0e56-45ff-b741-a02f4c236d12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139cfdb3-a7a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855866, "uuid": "01adfc54-499b-47be-a2a6-06ab0aa70c0c", "comment": "Malware payload (AgentTesla)", "value": "db795154a29915af2f49fa328d2638fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855866, "uuid": "21fa296d-8f11-4a56-919c-5c675aedf162", "comment": "Malware payload (AgentTesla)", "value": "8f4d4e697c678a71a111f4c5ed446659c9ae42c58b99e9ed1c86f7488c9c4e07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855866, "uuid": "54b07c5c-27e0-4423-855c-58e0eeb5a33e", "comment": "Malware payload (AgentTesla)", "value": "e93b3dd6d910985ca583960137520cc4c463bca7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855866, "uuid": "fa111b49-97dc-410f-8560-ee6d3b24b117", "comment": "Malware payload (AgentTesla)", "value": "fdf68f5dff31089f496ac3d00f7aba2121b9e71dbbf19e9faede9a41a3c2cfeadb1dcefd7226e96f6b15f3457c5147c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855866, "uuid": "37c83361-2bbd-494f-919b-307681427872", "value": "T1B952AF32555E85E8C11B182A6C11A70826DE3D0D39AEBE901831B1DBEF8FE33D6169C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855866, "uuid": "c50c991b-802a-4dd1-92a7-890cb04b30e4", "value": "384:E9NAR2hogiKsZfgOE9g8vgGPkd9fspVDiRfkZ:E9NU2hogAZ4OKoG3VmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855866, "uuid": "11857ef4-c858-4ca6-929e-24adf906f9b8", "value": 14312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855866, "uuid": "2c5a7110-d865-481b-ac0b-326f5d7f6707", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855866, "uuid": "c9f00973-7182-423a-b0f3-62fbb46b792b", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f76d58-a792-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675848345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848345, "uuid": "60983054-5639-40b6-bca2-fd53e326a9c0", "comment": "Malware payload (Amadey)", "value": "9ad6eff4a4219794a66d2fe9f6899c7d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848345, "uuid": "187f10d5-8a65-46a3-8cbb-6788bbba708c", "comment": "Malware payload (Amadey)", "value": "8f8fe7219c3f95edea206ba4eb97e787ea27faebb11ff108f5fef11a29ee432e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848345, "uuid": "37431615-afc0-4e7d-848d-897a428a5b59", "comment": "Malware payload (Amadey)", "value": "db0ac356ae9a8776e3689ef7114a33b81094ddf9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848345, "uuid": "dd01034d-7d8d-40c9-89f6-1f9ee9e8cdb1", "comment": "Malware payload (Amadey)", "value": "a401cdb13268c9a929d75dd0eaa94403a2553b36f1cf44bf0f8d06505d3ee691525104abda2976d3db9e9924ac4b4402", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848345, "uuid": "4be097d0-cb4f-442d-be55-415cca7dd88d", "value": "T1B5C41207F7EC5022E87117702DF742C31A3A7E709A38866B265B9D5E0C732A4B63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848345, "uuid": "74179a02-04a9-4bf2-ba44-b717965d858f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848345, "uuid": "d39b3c17-0c7e-4874-bc12-f3dddd623d6c", "value": "12288:XMrUy90x75OOv+o5d3lUwUkNUjFDe4uztklqtDRQnt6MMB7W3Wi:byO5OXmEAUJ7SVVaVK6Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848345, "uuid": "3bd32f21-d067-4fac-af9e-3a026e07a58d", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848345, "uuid": "07a616e7-c23c-4daf-b1ff-606556d37581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848345, "uuid": "ec504979-25e3-4500-84bb-e1f902df4178", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0eaacf-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675882133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882133, "uuid": "3bb56001-8c01-4e2e-a139-8be67ef3d021", "comment": "Malware payload", "value": "af74e94c6f87619a7dae57967f4c4898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882133, "uuid": "49bc3172-b024-443c-a261-316647ebb881", "comment": "Malware payload", "value": "8fb5fd7d1966ce184b87ea565e3eb6e7c310f6b96424e1122dab6804a33e55fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882133, "uuid": "30a75099-74a1-4e1d-9288-61c029ff3738", "comment": "Malware payload", "value": "fa4971a87b9ca79feab5898124c4adff22a7bc66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882133, "uuid": "d4ff3c1b-df31-4c98-88a6-194610a9168d", "comment": "Malware payload", "value": "fada1a046a0f24c800d3c06b437f30af353bf075ded756bc51fda1cea162391bc322eb0729796d022f642f06a457986d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882133, "uuid": "f1d3a4bb-2d7d-4cce-8793-095346c844dd", "value": "T1AC25AF22F2D18537D1331A3C8C5BA3A99829BE512E38B94B3BF51E4D5F3D68138252D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882133, "uuid": "1c0add59-5dca-4b25-92df-ddbbdb8c178f", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882133, "uuid": "9a811983-a565-405f-9b7b-bdbd2aab7241", "value": "12288:lMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9dpDn2tZKCVzIK3uhal/Ry:lnsJ39LyjbJkQFMhmC+6GD9BkzIs5pRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882133, "uuid": "ed1254e2-42bf-4723-a49e-3480d854d8af", "value": 997180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882133, "uuid": "01820e4f-8722-47b1-a892-99ca10d4c453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882133, "uuid": "e0f0438e-d4e6-4fac-a084-a214b3d5f9b7", "value": "af74e94c6f87619a7dae57967f4c4898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b31f0d-a7f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675892348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892348, "uuid": "bcba94e3-4f54-4484-b000-6ac367404305", "comment": "Malware payload (Formbook)", "value": "d10e61e54d51426089ce5af2564f7b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892348, "uuid": "ee65c92a-3fc9-42ad-9998-b685b092b159", "comment": "Malware payload (Formbook)", "value": "900c2fe03bd37e7c93e1a6f3d36febf624bba367bb80a25cc5c075d7795017cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892348, "uuid": "b6e1f1c6-d330-4729-8009-28c69b6e1cc3", "comment": "Malware payload (Formbook)", "value": "63b64eb9cc9f354b8dda8841aa7f16806619d22e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892348, "uuid": "8f2b4380-4067-44f8-b92b-64c6ae8b280b", "comment": "Malware payload (Formbook)", "value": "03c0b0d4aa7f7af51b7f977e3c53ac0eb0fc77fdaf2be94a9c3ee7a114763775632529fa4db9f7d9e925ba9a85580430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892348, "uuid": "4463ee56-dec2-48b1-bbcf-d1cf1bda306f", "value": "T18A154A3E19BA57E2D179FA3942E18420F6EC93837303C998EDD62AC4CF015856EDE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892348, "uuid": "621ccacc-2173-4687-9f29-60b8cdacc02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892348, "uuid": "e3b16647-860c-47a7-968b-9af38df0a7e9", "value": "24576:klcI7MTyPdLX2tuCAe/ZXJ1MSrS+JPdkmlkbYzP3ofs8OxltKwJbK:BGSzJrlkEzP3D8KrJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892348, "uuid": "a30810ea-4c49-45bd-af29-118484897ad9", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892348, "uuid": "af492a26-5093-4c57-a3f2-98225ddc2ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892348, "uuid": "603d314c-020a-41da-af04-fcb5af6dccdc", "value": "POFDA37870023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a174f-a793-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675848720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848720, "uuid": "7a626088-0d40-4466-ae4e-174999b58c2d", "comment": "Malware payload (RedLineStealer)", "value": "899937ddf52b1cfa54914fb0f930b052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848720, "uuid": "702b6619-c7df-43d3-bd0a-d462328389b2", "comment": "Malware payload (RedLineStealer)", "value": "90357f0bf0990f652eb4f8d87bb26abe259282090c440fef435cb20519f026f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848720, "uuid": "72fc00f6-4b95-42c5-8112-f92a868d1cbf", "comment": "Malware payload (RedLineStealer)", "value": "f30adf56a930ab34f6c05d36a47352bccfa531ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848720, "uuid": "62b6c8a4-3a21-420d-a597-f63a7d26cdab", "comment": "Malware payload (RedLineStealer)", "value": "4cf4018144a11283e9cee08dfc6460f76800d3389a1512a9297c9e12d0ecac4f858466b0477510e9b5c421266b93c720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848720, "uuid": "feaf8e39-3ee8-43f5-8cb1-3db0a642ce45", "value": "T144947D53A3E17C58E9258B73EE1FC6E8F60DF550EE0B37A93229AA1F1870172C567211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848720, "uuid": "db6aa747-3f24-4a4d-b0f8-65a1ab5c4ba4", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848720, "uuid": "a87dbc29-ecb5-4009-8074-feaa2b0ca366", "value": "6144:J6b+qG1sA5k449hyaAaG2kgFkUEtF2IIjVeuuWUj5I:JAu1sA5ktzxVG/gFG/AVkxFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848720, "uuid": "eee82531-2dce-4674-bfbb-631a8e60bec1", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848720, "uuid": "75015eb5-259a-4396-bead-faf2ade13e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848720, "uuid": "ec0254f2-e9fb-46e0-aae7-dd5638b9a399", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a94f369-a7a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675856414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856414, "uuid": "1a2d2f17-6220-4d64-95f2-cc5965fe7f3d", "comment": "Malware payload (Amadey)", "value": "5d4386bc062d8a838c5c225929286054", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856414, "uuid": "1d929097-e509-4de4-81ff-2659cd4682c2", "comment": "Malware payload (Amadey)", "value": "90c09e9c6e701b5a22c6d2b5618ef48d0a70e679e19cff327d4527bee4190222", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856414, "uuid": "e9fc5952-bdb4-48db-a16f-9fe090526590", "comment": "Malware payload (Amadey)", "value": "37ad324a28e2326b6071017b11c12802612b16da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675856414, "uuid": "acc6dbca-cce3-4c59-ad39-c06de3f62cec", "comment": "Malware payload (Amadey)", "value": "ea6463c5dfa4f303e23a37d452d45f857f5506ebe7cecd86ad4241bf64d3f7e226c0da66dcd57f0c6a968e8bcc1f553c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856414, "uuid": "e82741e2-e234-429f-b723-0edae7948582", "value": "T11AC4021BB6EC8432E4B513B019F613D3093BBEE15A38839F128A6D9B14725F4A631777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856414, "uuid": "61c2970e-0ea0-45ec-bfc5-91a369e256dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856414, "uuid": "685fc96b-82da-4427-a71d-d9bd6fbc2057", "value": "12288:aMrry902TLCpJGneCVGrtEsIdYh32gYgJ0qBcGejaF:ByfPCpJIKEsue32VEBcx+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675856414, "uuid": "8edb2350-52b6-4771-8528-c6f36b03efc9", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675856414, "uuid": "03c5476f-c195-4fbd-8802-967a92222821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675856414, "uuid": "f02ac4a4-b71b-485c-9ac8-1b965d06d8e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c7d4c9-a7c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675871417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871417, "uuid": "e3beb048-4258-4cb5-bcaf-63724d7c333a", "comment": "Malware payload", "value": "ccc18f54f77f5b1295f3b4cc3509cb3b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "PixPirate", "colour": "#2DBF56", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871417, "uuid": "d4b1a794-c860-41a9-989a-6cbeba94459c", "comment": "Malware payload", "value": "911fa473f75d48e28384023b4a008d6d0877ad0fa58f9ebf38da1b02a1481314", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "PixPirate", "colour": "#2DBF56", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871417, "uuid": "da396aad-5ee8-497c-9a4c-53eae5f97ad0", "comment": "Malware payload", "value": "d4d72200212c9cd8c83b7634360c500a999be1f5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "PixPirate", "colour": "#2DBF56", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871417, "uuid": "c3f82108-4e17-4814-90d3-07ab41afe81a", "comment": "Malware payload", "value": "9ad12c37a1eee82ab8c32ecdde20c2c38a778f327da36e4d5e9525b05d1d502392081c441ae18c997e22c987c5b07d6c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "PixPirate", "colour": "#2DBF56", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871417, "uuid": "dd06fc82-76bb-45f6-98dd-99a4f6e800fe", "value": "T1BD56E0C3F77AED2FC4B761B249694231AA764E118A83578B18083E1D38B76D90F49FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871417, "uuid": "51a57ba5-39cb-4197-832c-74a1addea6fd", "value": "98304:IJkmaHK/jhZPGq8Ckco6R1xnJjQVQ0QsTS4okvSGl/lfg1xBF2QreR8X8yW8:IJkpMjD+4oK1NJ8V3TS3k3NfaK8MyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871417, "uuid": "d020e3e9-3a69-46ef-94e8-794eaeb6957f", "value": 6361267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871417, "uuid": "81ce7bc7-cb18-4ac6-be4d-e8e8086703b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871417, "uuid": "cc9df450-cabf-4737-ae31-8dbb9e83b8a9", "value": "911fa473f75d48e28384023b4a008d6d0877ad0fa58f9ebf38da1b02a1481314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15ba997-a7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675869848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869848, "uuid": "8ea64749-ce08-4687-9464-8e52ec909695", "comment": "Malware payload (AgentTesla)", "value": "d8166cc8424352c445ac8ad3842ac9f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869848, "uuid": "ecba7625-12dd-4fc5-9cf4-de7e9993225a", "comment": "Malware payload (AgentTesla)", "value": "9152d157feb2720a061370f67e54e2e772a220e0f5128df607d05c6e709ee1d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869848, "uuid": "c5aafc1c-6abc-4fa5-88d6-6b77375c2014", "comment": "Malware payload (AgentTesla)", "value": "13c74776d2d3362192c5afca0ea8882d4c9d6d41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869848, "uuid": "fbf5e81b-f60b-4698-8fe7-d2c88dd88553", "comment": "Malware payload (AgentTesla)", "value": "fd4058c32f90ba9723943effc75090a0f0296ab24876aa2daebfd789b86f699b1ce74bda76a8a5dfeaf30449cd53a9d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869848, "uuid": "a3160d95-fa4e-4150-a04e-bcb5a723f2e0", "value": "T1666423D9199B381C03F5563748B292C06FD3787777169EE41ACA860886ACF52FA41F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869848, "uuid": "ca7ef280-fd8d-4f82-a00d-d302dab1a083", "value": "6144:5St9KTcYebyHPY5usr/AlQuIECyoDZ2b/U6kQPSmwZ6iDyAWY608Koy1a5kno:EtYcYW8PYPAQuJ3os8fZTiY60StJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869848, "uuid": "f1afa2c9-54e4-447e-959e-071ce1829c54", "value": 320678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869848, "uuid": "f0c22f4b-8b06-451f-909c-c00c20ef1c9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869848, "uuid": "6f68aa61-1629-4891-bd49-0933da57a7ea", "value": "DSG2011001_INV+PL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c81b4a7-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675853787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853787, "uuid": "b210471d-bc0d-498a-b6c5-38963c3e886e", "comment": "Malware payload (Amadey)", "value": "36bd03e229b8200ff6dd9eb3c7a4533a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853787, "uuid": "d51a7ecb-f2c2-465a-b4f7-b295dfd75691", "comment": "Malware payload (Amadey)", "value": "921c4df2967bf7f3abb42f2532799448095938c9fc09329c0ada8de7bef322c2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853787, "uuid": "16bd3fd8-3669-413b-a0c4-eb07640e7353", "comment": "Malware payload (Amadey)", "value": "22526e2075d10976fbb3484ff786c10ea85450c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853787, "uuid": "b7d670ed-bfc2-4893-88af-b0d8ddb334e0", "comment": "Malware payload (Amadey)", "value": "946e770bcf96825426bc815915b0cfdb1cb2a4ed718a19b5d3d3fb5c8759dde22d04c2f2468d30c85e4dd807a8801023", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853787, "uuid": "701783dc-1581-403c-aca0-376dc6f35566", "value": "T120C40247B7D95232E4B153700AF707C31A36BE619A38839F274E5C8908B27A4A77573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853787, "uuid": "417fc1cc-c3e9-45eb-84dd-0c60df46498c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853787, "uuid": "ee9139e5-b933-4b63-a95f-40aba9ea44dc", "value": "12288:/Mrmy90RNdGjpkhfs2dFNmSu9DxBFeJAAsnvopQWNkel44:Jypkhfs2vNoDdeAKQWKiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853787, "uuid": "06d9d63f-caa2-4265-b304-960d1dce327e", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853787, "uuid": "3d88c497-77f0-4c88-8eb7-9d6417bfea3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853787, "uuid": "68b282a9-b361-49a7-9470-7f41082cfa14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257ced22-a772-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675834421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834421, "uuid": "d7ff007e-8bb5-4828-8756-9e2cf145d5c4", "comment": "Malware payload (Smoke Loader)", "value": "cc28b08491fb6e4d3f3a531773ac1a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834421, "uuid": "4792a0d3-868e-4100-9cf8-2ddf1b85667c", "comment": "Malware payload (Smoke Loader)", "value": "9228a3fb8ca1c7a9d43fad614127b1abce522a6d5127810401873b8abfc3be69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834421, "uuid": "3133ad1c-e098-436c-b94e-08978ad73ecb", "comment": "Malware payload (Smoke Loader)", "value": "e87e3b50ae0960d652a8911d8a4979b76f907cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834421, "uuid": "5fefd5f5-b431-4570-9cca-c1c2e713dd0d", "comment": "Malware payload (Smoke Loader)", "value": "fed9db7a98eb649c2c26e3536fc13c017fab2279e8075ae99b63ab51d8fd747765190dd59ef18836a234f3221c02f801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834421, "uuid": "86f98d3b-fa48-427b-92c5-2c978a8bce79", "value": "T19F643B53A3D17C48E9258B73DE1EC6E8F60DF590EE4A37693218BA5F18F2072C563A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834421, "uuid": "9fc3e324-6907-41da-bb55-b48e392efd0a", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834421, "uuid": "c7df44c1-aa74-4f4d-993f-377b11b34836", "value": "3072:CwxqQH6wXR5+TxSYnl04iGNUrJAEgJbDfx8+69aiFSKlWByUAl1nzBWu:C83aU+TxSYx7fNKf0iXWUjnzIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675834421, "uuid": "0c5b654e-a5ed-4331-891d-2eb5b65309a1", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675834421, "uuid": "6b6233b5-bee0-4077-b408-ff50a50376ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834421, "uuid": "501e4950-31d3-4a45-a58d-50e4d9020158", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9686f296-a7f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890875, "uuid": "5afc36da-a69c-4fae-99a0-99bb5594bca8", "comment": "Malware payload", "value": "a4d17cf7731e877e5f751dc4cee4750b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890875, "uuid": "332d1c76-3895-4c69-8730-ac5819708a1e", "comment": "Malware payload", "value": "9378fd6c9ce117a54d901862b08362585f3b7c4d9df2a3835560e5e4a28f6cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890875, "uuid": "abb7a26a-3e1e-4b6d-ad6b-bd8651fb8f01", "comment": "Malware payload", "value": "187a72849ea625f1707141337d39d2028f9cdbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890875, "uuid": "f1766f77-4356-4d4c-8a55-34d1f7dcffd5", "comment": "Malware payload", "value": "4bc320b8a725687245668826caa3c62a86bc552b56c50fc438200aa9d2adcee37351adfc39c4e59f281affebf14758b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890875, "uuid": "2ecf2ee7-b51d-4be1-a301-ab1fd4ce0726", "value": "T1D6D4F1A9FB10E80BD95A0F380C95D1695E60BE503C54C953B7E2BFAF3F3A6C2B914046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890875, "uuid": "59df4cac-680d-498e-9bad-42779dd28937", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890875, "uuid": "ae7b303b-fe7f-462f-ac13-d2fff6d7eb50", "value": "12288:Hbif/mHZzu6uhuQgRN6Zuj90Z2upnD6z288VMd1L+kN91weGhLpvA/X1Ni:7if/mHZzutuQgHt90TnD6y8eMd1LHbuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890875, "uuid": "0f66acb6-73f4-4c03-89fb-63e8876f8ab4", "value": 633000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890875, "uuid": "35814fc3-213e-483b-b863-0022100ec289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890875, "uuid": "220ec696-5426-48f1-bdcf-6baf161ea509", "value": "justificante de trasferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8689c71c-a7ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886982, "uuid": "43cf7a27-9568-4cef-b881-c44f7322dfed", "comment": "Malware payload", "value": "cdc753f842f874c9b6563cfb62074b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886982, "uuid": "3e25cfab-fe6f-45f6-bc08-dc261af609b8", "comment": "Malware payload", "value": "93b572341140313e547f17b1f3e403cd0643282e6f6858be2c67e46bedcdbbba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886982, "uuid": "bda07034-dfad-4247-9c5a-69f93cc3b6e0", "comment": "Malware payload", "value": "60a17a4b9260b53865208c6b415d9a3c0b9ceaf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886982, "uuid": "ace844ef-52d4-43fb-b2e1-e57fb1e75f23", "comment": "Malware payload", "value": "7bc0046945a283ed12f12e6deb040d88f9b3c4934345732e9619112bcc21c7142bb26112e725f4352bc640f7a0b5001e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886982, "uuid": "111470e0-871e-413a-b827-57a64e9d5aaa", "value": "T15AC40207F3DE5123E5B467B018FA03D70A37BE622B79C357268A6D5A1D72250B13432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886982, "uuid": "cd4a8bf0-87c3-457d-9495-f3bb539eca51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886982, "uuid": "fbb69160-fd89-4987-b162-67bae40855d7", "value": "12288:1Mrly90AKpvARhaEWG2uM6kWOgr/+H//4LIheU1:8y7KuXmGtLpr/uIEe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886982, "uuid": "9ebbb208-7d72-47ed-afca-4534439b8a53", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886982, "uuid": "3077fe9f-b916-4113-8928-0ba18a31649a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886982, "uuid": "cddba344-3e0d-4409-8b2c-ff27297b9bff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999d910a-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675853943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853943, "uuid": "32f2b17a-f2a4-4e02-ba9c-2063a62a2557", "comment": "Malware payload (Formbook)", "value": "8cc95a29b5fadc04975ccf048bdb2972", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853943, "uuid": "7df8193f-6f2d-4d6b-ae3f-e0e8f8115e2a", "comment": "Malware payload (Formbook)", "value": "9453f03883b60dbbaa033c3529dcf915e2ad8e01939913092f0b64938f2eaf12", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853943, "uuid": "12121792-b5de-4f4e-a2a1-ed0d059e9857", "comment": "Malware payload (Formbook)", "value": "506f69d37e7a84f61a86f2ae6a49f4f51553404c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853943, "uuid": "93adc70a-62ab-409a-90f8-c4e6dbba7e73", "comment": "Malware payload (Formbook)", "value": "1afb5f17d71cc1fd693fdc5db843590802a6c4ae1a038f023ba29f81f731ba804228b71ca8ed19cc078ca00756a92ba4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853943, "uuid": "b8af27b6-a017-486b-9738-1aed310e9d43", "value": "T1FEF42332540AC80EE3E2C5725997DB8CE6DC8EC07AF780FDAA54D524631B5D25E6B02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853943, "uuid": "54ef050e-b39f-4e42-a3f5-420e450832e5", "value": "12288:VCuJYPwp4at2d+vqIvs8VhTznwALh6jQKN2Ksea+RuTt8o:3US4a3vLs8VhTkt8KseawuTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853943, "uuid": "4aa10bbc-96fe-4de4-bd89-0e90ae60c168", "value": 752610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853943, "uuid": "3edb23fc-c053-4fe5-9dbb-2b6f8608756e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853943, "uuid": "516ae137-a2f5-4bba-96a8-1d66be096c8f", "value": "Original Shipping documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd08f44-a7e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675884468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884468, "uuid": "f9c9e79d-a370-4f84-9e58-4443ffb9820d", "comment": "Malware payload (Mirai)", "value": "fa415e86102e4f70ec58e7a8eae3fbff", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884468, "uuid": "4d40e810-f051-47f7-b1f4-6a6e8848d373", "comment": "Malware payload (Mirai)", "value": "9476d1e401095ab67de7a8911942c248cceca6e61793147a7363e0cfee93ed90", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884468, "uuid": "6ee82839-b6f3-40f3-a439-5abf6f76981f", "comment": "Malware payload (Mirai)", "value": "5556fe85a8b618cad12c837df0e3f11e54128f87", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675884468, "uuid": "bdfb22f0-1b72-4649-871b-28b3a5aac49b", "comment": "Malware payload (Mirai)", "value": "1e700bcd0b5cddbdbb1d1f33021656677356c6605a147a2597723dad354401f550040d3a0503b36fe463ab4ffd3ae48e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884468, "uuid": "25638289-d99a-4f4b-999a-d5a55968fc60", "value": "T1E7534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884468, "uuid": "1f40c6ff-0351-4c80-92e0-90022887432f", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/mDiQYLiKimfFoktCe3fYRM1:WShU3q7cEDlCK/mDA9i8Fok06fYRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675884468, "uuid": "906a95d5-e8ad-44ba-bc7c-844de47feb05", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675884468, "uuid": "65dda6a6-cce8-4c71-92b4-75ebd07db93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675884468, "uuid": "de2ff447-e12f-4d0c-aecf-eb5a9ce4c0bf", "value": "fa415e86102e4f70ec58e7a8eae3fbff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be493d3e-a7a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675854434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854434, "uuid": "bcc275b8-72d4-4dc0-98cc-8b66a0597804", "comment": "Malware payload (Amadey)", "value": "616fce3b63236b952e06e7e52bd34748", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854434, "uuid": "fcb23477-4c56-4872-af50-ff33e0e0e282", "comment": "Malware payload (Amadey)", "value": "94a08dc17c1760288363b5613821b7eb765b7efd03dd5a0de2ad3aca4feeb147", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854434, "uuid": "93e4b5de-4a9c-463d-9840-d81391906b22", "comment": "Malware payload (Amadey)", "value": "bd879999b725cd175376bffa8dd353d6617eb6a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854434, "uuid": "bf5a4265-189b-475e-a0a4-465e084cb467", "comment": "Malware payload (Amadey)", "value": "527214e4f44ddac61b38149777879e0d939a9213e11d963d786a2ea981be31d96f3a3558c6ae89bc74a2390414c68e04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854434, "uuid": "ff59b093-3486-461c-89ec-bb2935078079", "value": "T161C4021BFBEC9032E57067B019F603C30A777D60163883DB274A6E6E1871AA4657673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854434, "uuid": "a916bb91-8747-456b-9e0d-063aafa37d6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854434, "uuid": "f6c25638-ee1f-48ee-90cc-73b47786c5fb", "value": "12288:WMrwy90I1R2p3a7qYgjyKKudRhE2dY+L1tXvJIZ:SyW5fKEfE2G+mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854434, "uuid": "2bb3e7e6-79ab-4114-92b7-c02dd9531008", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854434, "uuid": "bd30e80e-feea-4372-affa-332b8fcd2921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854434, "uuid": "0d0ae64d-0e04-42ec-b100-fb448db29f17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48da04df-a7a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675855526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855526, "uuid": "44516965-4410-4c4f-ae35-7e80167acff6", "comment": "Malware payload (AgentTesla)", "value": "80b9c782dfd59a7fdb603964bb3f9c0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855526, "uuid": "43f262bb-5616-48d3-ab4a-dd197ed73abb", "comment": "Malware payload (AgentTesla)", "value": "94b676c46d5921cd8f602aea9e3d61e1ca1fddb7476212a6815db3a1ddd41ece", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855526, "uuid": "bb6caf34-06f0-4e9f-9afa-82ec4dd41a88", "comment": "Malware payload (AgentTesla)", "value": "e2a7b969b930bfc44aa76a7f9a2eedc5cc98d8a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675855526, "uuid": "71dc3c2d-3ccb-4ba9-b359-6bd3b368781d", "comment": "Malware payload (AgentTesla)", "value": "c120a6f00e5c5dfc00ede1cd5cd9b24473874eb8250e8af480d754683a2126a5dafd905e02b118e1265728d3c5eacc69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855526, "uuid": "90c87e16-4b6b-4f3d-8a1a-c53e10edd20f", "value": "T119F4F0425957CD54E3E40A7DCEFD072883E5499917F3E37A23E411E58E037CBE80AA6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855526, "uuid": "49d77de7-3e60-4589-a318-4b46382be659", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855526, "uuid": "2ad5b721-f587-4736-8d22-f9fa93728fc4", "value": "12288:q7tHoUHNrI2iNV66BbW66BlrAoj0XDnpa0628dbpcFAOo7V9kO:q7xI1nVdWVPToglzAooO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675855526, "uuid": "d0773816-3fd1-4e32-a820-ed1240723130", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675855526, "uuid": "e49ec644-351f-4145-ad40-22a70d6a08d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675855526, "uuid": "a074ec21-1bbb-4afa-9b92-bcf633974c56", "value": "94b676c46d5921cd8f602aea9e3d61e1ca1fddb7476212a6815db3a1ddd41ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86118b6e-a7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675880539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880539, "uuid": "12dfb078-452d-4859-b011-fcd9811f98e7", "comment": "Malware payload (Amadey)", "value": "745b65b9f656f0852d193beea47f587a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880539, "uuid": "59d8b594-3352-49e0-ac5d-3cb338636ede", "comment": "Malware payload (Amadey)", "value": "94bf11fd7c49f2f9354f11fdb6f9d02064160f3e56c656991b08cde749d5987c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880539, "uuid": "cb3f8aa6-b8db-4fc0-b2c2-b8dfa29dea38", "comment": "Malware payload (Amadey)", "value": "058195590f4022b05b3322f2500209aa5cfaccfc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880539, "uuid": "00584790-742a-4413-80e6-740874247517", "comment": "Malware payload (Amadey)", "value": "b3388a376e520c65d376c8132b3fda0a1f7911d2dbe7b62a5ef8e72737ffc0a7c57d32bfd659ecda7a4f4e84bbb2feb9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880539, "uuid": "20aff81d-813b-49a5-8763-90abb690c0f3", "value": "T10DC4121BD6EC8036D4B517B428F642C30936BE616B7C869F628F9D4E18B31A0B13137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880539, "uuid": "a1d90754-d24f-4571-8f67-2626c9233c9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880539, "uuid": "ccde7695-cbb7-4b2c-96d9-2a1289c4ff6b", "value": "12288:oMrzy906twJPiVVISHr7avTHl4tVWS1ja0eKytMXrdRrO:ryFtWi4KuD2XWEeKytMXZ9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880539, "uuid": "f9394c43-8e83-4a92-af68-36082dab77a4", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880539, "uuid": "51245f3f-81d5-432a-84a9-7d2e8f4eed38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880539, "uuid": "3dacd3c0-83be-486a-9d12-1c168b10f150", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a2c031-a79d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675852965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852965, "uuid": "480cd40d-a376-4dd6-b085-5f9f067848b0", "comment": "Malware payload (Smoke Loader)", "value": "4b4cb72de0a4c5dba652242483a284b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852965, "uuid": "09319c0b-3ad7-49a8-be6a-779d811e75df", "comment": "Malware payload (Smoke Loader)", "value": "9509a4d5b9cea8cc11bb4a3c51e951ed77ab035e8c8597a55febc8c15b22832e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852965, "uuid": "9be4fc3f-e1ec-4fc1-abf3-b922708b8ce9", "comment": "Malware payload (Smoke Loader)", "value": "85c8881e2de13b97d9c61467245a53ba7013a6bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852965, "uuid": "b17ccd75-a02d-4ab4-b861-f8582899ad3f", "comment": "Malware payload (Smoke Loader)", "value": "cd0516565f70899d4cf06596a19241385fd0bbf214c332781a5d1754dfc7ef541a25a702da459d2c773217246bf59dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852965, "uuid": "84a838be-5eeb-4269-b743-c4898662dbb5", "value": "T14E644B53A3D17C48E9258B73DE1FC6E8F50DFA90EE4B77693218AA1F18B1072C563A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852965, "uuid": "681a93c9-c0ff-400e-9f87-0a3a96318fab", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852965, "uuid": "e2b99621-bdae-4f0e-9845-93806fa0ed40", "value": "3072:zwzqpQSjGtRlpozdbX0WWZXBZhFMfrzbQQWByUAl1KiBWnU:zuaQuQ+z9kDXPhynMQWUjKiIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852965, "uuid": "f6f90cb7-6689-4b34-93e7-4c5cb3c4e6de", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852965, "uuid": "c2457c5f-e417-4fbf-8ff6-9bbf9d2a398b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852965, "uuid": "c9178192-5c4c-4988-b31b-23bd8e939543", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e677d75-a763-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675828181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828181, "uuid": "cbe27e46-7bf1-420d-9a4f-77c2c1d8dd55", "comment": "Malware payload (Smoke Loader)", "value": "8e99e02b5bea9bd3cb73f054621d2f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828181, "uuid": "6142235f-7509-4e5e-9290-b346bab1ce70", "comment": "Malware payload (Smoke Loader)", "value": "950a5f353d52d0dd13ca84ca78397ccd460e805590f4dbe0940f44da99aabf06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828181, "uuid": "23f5da66-a379-4752-b01d-f3811ca0dae4", "comment": "Malware payload (Smoke Loader)", "value": "ed4d73d45b7d11db5f00937d658fb85bd82f4dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828181, "uuid": "2f8905bf-e212-42b2-84d3-9bd7d5ed5be3", "comment": "Malware payload (Smoke Loader)", "value": "a15608bb4beb889a6953ddb71d1a0d7d9f2f392dfc757c0044e9dd9fceb7905b7fa788ee8a4bd72a562d0dc5fa02393c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828181, "uuid": "f34029d3-b590-41bb-8f73-47ef810c6cf7", "value": "T10C14D03236D0C472C4AA1470EC64CB656FBEB9318671DA8B7768176D5F302C2663E36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828181, "uuid": "f6ed57a2-293f-4278-bf61-f689cb6644af", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828181, "uuid": "c529a927-2c9a-4bb6-80ef-8ecdb5d9a2d5", "value": "3072:zfcOiwEigbeqLASQWha5d3rWCkBBylax5nzwpHJvVq8X+lMpzIOMkB:zfcVJ9LlQzpkqKFw9X6omkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675828181, "uuid": "67bc7ecd-639d-437d-acce-c640689d85c7", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675828181, "uuid": "5ec131d6-3848-42db-8ff9-da35800a4af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828181, "uuid": "2cc6e8d3-bdba-4237-b805-739f300c13ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda9a616-a7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675872472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872472, "uuid": "9b2c7464-20a0-4ed8-8ce2-7938fe698e98", "comment": "Malware payload (AgentTesla)", "value": "424bfecc7cdf3c3c65c1108f3adfe647", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872472, "uuid": "786563e8-2df7-48b9-a051-841d12b8249e", "comment": "Malware payload (AgentTesla)", "value": "951c89cd0a8e542c86dadce31b09074e5ca2e02ae37fa25f5abe05e0d1a5f930", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872472, "uuid": "bd415a5a-790e-4d5e-bb3d-4821c0897f6a", "comment": "Malware payload (AgentTesla)", "value": "e67588ff4b35e0749d37fd316243a6056872be2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872472, "uuid": "34b4d60a-b61e-4511-8150-63801ae83fb0", "comment": "Malware payload (AgentTesla)", "value": "1375adb646b87686cfafdc1219244193dbaa82202de9d534f5fe5f47d11a0cd3b3d38deb1179c391b9b9576743cdae03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872472, "uuid": "aaa89065-fbfb-4a62-8d94-e30e175d83d7", "value": "T1B86423D9199B391C03F5563748B282C06FD3787737169EE41ACA860886ACB52FA41F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872472, "uuid": "065f66a6-e544-4604-ab1e-1bd0f37229cf", "value": "6144:0St9KTcYebyHPY5usr/AlQuIECyoDZ2b/U6kQPSmwZ6iDyAWY608Koy1a5knn:9tYcYW8PYPAQuJ3os8fZTiY60StG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872472, "uuid": "3de0b16e-5e7e-4829-aebd-2449f298429c", "value": 320674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872472, "uuid": "9cf25b44-ead1-45b9-a175-08c11d0db6f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872472, "uuid": "69da73ec-78f7-4385-a1bc-584f391a360d", "value": "SHIPPING DOC(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b91355-a7ff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675894918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894918, "uuid": "956b5aec-aa59-4187-8d38-8e899ada55df", "comment": "Malware payload", "value": "660206693adbf4c2c8019fe4f345c900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894918, "uuid": "503baa22-4b39-4ee0-ae1b-43f0dfda100a", "comment": "Malware payload", "value": "9528fd7b7d50490d4ff7a67eac5c1dc370b912b5bd3d940799424e2aad9d023a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894918, "uuid": "e55b547a-f55d-4a7b-8c2d-5a63101eb00f", "comment": "Malware payload", "value": "607c1f26d88e942be39defdfc6ff28bb35f10842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894918, "uuid": "f1046d27-a80b-4706-91eb-5e3f35c1fe68", "comment": "Malware payload", "value": "3e5096978ef3474afd78fd72fd2d9cbf728aeeeea0a7f7c2f42dfd39aba76eb5bb7c6c36558a98211a84bac763ebf87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894918, "uuid": "2538dcc5-4e4d-4057-b2fc-e85bbcb80bbb", "value": "T1C0C4120797EC8423F8B5577019F603D31A31BDA06F3C83B7574B981A18B3AA4A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894918, "uuid": "ba04e9f4-f5a8-46dc-90f5-2c01c2e9c12c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894918, "uuid": "f7873a06-b2a8-496b-b180-0e2e5ed2ce06", "value": "12288:JMrHy908/Fz7/um3xgUbP+UoqhUNkDXi0fBe8f3QPr:OyH1/33KEP+UbSybi4Behr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675894918, "uuid": "36534ada-42d3-4d89-bfc8-fc5c7178b888", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675894918, "uuid": "27a618a5-cc4c-46ac-a298-6aad7284667a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894918, "uuid": "ab42c165-56aa-4093-a21e-f650b7a38d56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034db35b-a745-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675815036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815036, "uuid": "7d370065-f6de-445b-8d03-971e90595285", "comment": "Malware payload (Amadey)", "value": "b2967b20f245b217c74fcd3ea1b59757", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815036, "uuid": "bfc4b86d-63ca-4182-b20f-82c8030ab970", "comment": "Malware payload (Amadey)", "value": "956c79cbf4903db33390efb02be3592cfe619142e9b6c00ec680d6967fb6e50a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815036, "uuid": "496fff85-2183-41c0-9a7b-453c8b62f8da", "comment": "Malware payload (Amadey)", "value": "06850143a8a1cb85fbc78c03bfe3bf58787d61bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815036, "uuid": "b482e521-27bc-462b-a8ee-47b1a77bbca4", "comment": "Malware payload (Amadey)", "value": "a751f3cf0eac528c3ed91c10f20112b5e6a410530f57e91abe283e0d89b1d3fa238995f306a67b81648d2e72c22ee8d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815036, "uuid": "39b3454a-5973-40db-96d6-38307ba0d7a2", "value": "T19CB4024BA7DC5033F8B417B419F203C31635BDA15B38936B364EAD4628727A4B63276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815036, "uuid": "94c92c85-6536-465b-9b3b-cabc3d135acf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815036, "uuid": "51b8dbde-8ece-4730-a98e-f57be157d889", "value": "12288:EMrIy90WoxA0fVqtH0oUAuGiJPGr4kPRu2GJdd6cXWtslKrF0/bVN:kyx2AaVCH0oZpr4kPct9PXWtkFzVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815036, "uuid": "983f4394-37a8-40f4-8700-80039d60da21", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815036, "uuid": "e354679f-2280-4a61-a6e9-eb1cc9073e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815036, "uuid": "202b5c6f-376c-4f6d-a52f-98253c4453c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bce58f8-a7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675889837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889837, "uuid": "bb35654c-fae8-40f4-9c8d-4b73ea9b591c", "comment": "Malware payload", "value": "d66fa9ad8292339a6cb6f8ff757c7271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889837, "uuid": "458a245e-2dc3-4c48-bbb6-9377f1c92634", "comment": "Malware payload", "value": "9597c83f724eb98ece273b1e8c947d10d7468383fcd61b2030a4d571a2852e61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889837, "uuid": "d23751c0-b9a5-4cec-8734-17807cb0932b", "comment": "Malware payload", "value": "4cf3067fbc527d578c39af6a68b155391ff07915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889837, "uuid": "7ebc1197-d619-498d-8389-24835260cd02", "comment": "Malware payload", "value": "66a9595c83026f2b3bfe1f271b5f4be8fde5b6ae6c11c042a76710f9e76cffc40552eb518f710e5d582ce3001364606e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889837, "uuid": "6220b69d-4e17-422f-b34d-9c8ccc6c03b4", "value": "T141641903D2E27C81F9668B769E1FF7E8764DF9608E4AB7653218DAAB14F0172C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889837, "uuid": "029401be-c993-4826-8276-f679fa31a7a8", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889837, "uuid": "6d82c0f0-a251-4692-b924-631aac8c53db", "value": "3072:PPgHonTU5RFz2Q8NDVJEO3Y/F8/y+nDAF2GURTsWQDiuLpTT8gv:PwwCiQ8HJ7oNMy+DAYcLiqxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675889837, "uuid": "4e588b2c-5b4c-425c-b4f8-eb562ff62c6b", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675889837, "uuid": "769751c8-1552-4117-ae24-a568d9f5521d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889837, "uuid": "58d0a70a-54e7-44fa-ab7d-50c1ceebc9cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cd2d00-a7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675870449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870449, "uuid": "be139984-3257-4dc3-be18-cca3a1af2f87", "comment": "Malware payload (Amadey)", "value": "faf62f8437de995c25e70aa6c61d2882", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870449, "uuid": "0061fb4c-1ba9-495e-be58-59dea544d6c8", "comment": "Malware payload (Amadey)", "value": "95a1f9660b53fbdb0dc47ed0ce4edb90c9b08df677d82f58d8105d17419919a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870449, "uuid": "b43fb528-7b2c-4b16-960a-01ee562b6316", "comment": "Malware payload (Amadey)", "value": "5bd931279e74ae94d174ced267f361fa2c5a7243", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870449, "uuid": "948afa0d-618e-4073-9cd7-cd9a4d3328ff", "comment": "Malware payload (Amadey)", "value": "e52ca581f5704216abd70803aec6c4a123805b331f8e9b5b18e321972ef6916f9fdeb53cf8138041e8fba3f51f651a25", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870449, "uuid": "a2af615d-4fdd-4012-8adc-cbd8f2fff05f", "value": "T178C4020BA7E84432ED6477701DFB02C30A36BD60AA35969B335E6D1E08B27B4B571367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870449, "uuid": "40b9b986-20ff-4027-aaf4-4cf6bea3b8ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870449, "uuid": "97c9b41e-ec0c-471a-8edb-c135a733e83d", "value": "12288:oMrFy90YXwXasYG01XJC84HCIqo62RkB:tylKb0u82qo6FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870449, "uuid": "12dded81-f592-49e2-a5e6-2c4b68e38a06", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870449, "uuid": "58651a9b-b5fb-41c0-b057-5a6a92a34c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870449, "uuid": "837597c2-dbb5-4bef-b0ea-dbc95d69ecfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3f10ad-a78f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675846858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846858, "uuid": "0d32485f-cd4a-44cf-96ab-e0637ab6886b", "comment": "Malware payload (AgentTesla)", "value": "8465786cff9bb83d05a52f79378e3b81", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846858, "uuid": "c78d8d6f-8f00-4eb2-9ee5-39a808a8950a", "comment": "Malware payload (AgentTesla)", "value": "95b419bb95e4fc43a53e70b4841a2712099eefaf1011443099d52094045a5f09", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846858, "uuid": "12d6397a-00f4-4913-a70e-ede101323c16", "comment": "Malware payload (AgentTesla)", "value": "1206492bb1e49355dec618472b15eaa86d831dbb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846858, "uuid": "76dfb1fd-a22f-4d92-ad60-97aa8c7e0647", "comment": "Malware payload (AgentTesla)", "value": "db8fcd3b17f4bd88e63c0e0833e6e56a0a7bc5b7cd415fc51554f7cac296249cda0aafac784973f42d0755370fd96516", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846858, "uuid": "d97c2afd-c575-488f-8b74-8ea4d3c63e7d", "value": "T181A423BFE0D5ACF85C9684E9523D7014E2B2465481ACC6245EC57E2DBFC64CCEDBA30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846858, "uuid": "5fb2db66-212c-460e-bde5-3413ce1308e9", "value": "12288:kjjDnVpJ9qwL5hHufPPugO8pyO2tapMP/l:QjDVmnugO8pyV4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846858, "uuid": "c224e0a6-9409-4950-98eb-01c2edf09265", "value": 449408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846858, "uuid": "f161309e-a43d-42b1-a961-32ea76ce21f9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846858, "uuid": "1599b21d-7335-4c6d-9ee1-68c90db00bd3", "value": "Packing list.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e205a4-a7f9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675892746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892746, "uuid": "455a33c2-1842-4730-a3e3-f3b5849512d4", "comment": "Malware payload", "value": "2a08a673a3a445ec95f77899be7f7015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892746, "uuid": "6a05ce31-84e5-470a-b894-eb5551bc7c41", "comment": "Malware payload", "value": "966ee9fec62120a52f807788af08b15b0f923ac750f168f8740b6de8c63b48cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892746, "uuid": "9bd0492e-16dd-441e-a7c2-3e55e5ff5fe0", "comment": "Malware payload", "value": "05922259b1c7199049e4bb0415cad471ab640cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675892746, "uuid": "f63c13a1-ad4f-4388-903d-d9531826992c", "comment": "Malware payload", "value": "a9f409ad57ddb2cac12822115d31b9ce187bf39f799ae268b1657a845be092b8cbe92f58494f2f68d53a9bbfc3821c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892746, "uuid": "eddce1b5-387c-4ce8-98b7-a7f16a39adf8", "value": "T1DDC5127C7105C8ADD680FEB48C3A99E74CDA2EE3E9E4A41230DD7F3F51B91858A1A417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892746, "uuid": "21e7393b-f255-409f-adfe-aab1574c216b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892746, "uuid": "76845fac-af0f-4baf-b1e2-1aa6b9cb8b70", "value": "49152:rdHrWHp3SfLpVi+EhEUtwLsitBI6MCc8btuWwBH1dDczVLCgv2MR:JHawL7i+EhpGptNMCcktuTBHPczJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675892746, "uuid": "c08aee17-58bf-4924-8b69-8d1ab8bb016e", "value": 2679949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675892746, "uuid": "5f84aebf-69e4-4813-87bb-17606e5cd32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675892746, "uuid": "d6e9a31a-931e-4e96-9ea4-28c5570ae16e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ca3818-a7f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675891605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891605, "uuid": "2be890ef-10ce-45bb-add5-ef2c7c040d1a", "comment": "Malware payload (AgentTesla)", "value": "9c30d0c7e1a93c6b102c00e8921a974a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891605, "uuid": "657c4b08-ca70-4051-8d4f-188e9996961f", "comment": "Malware payload (AgentTesla)", "value": "97510781022a321a48583288da5c06aaf7492d673e6c37c34133e04a74485503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891605, "uuid": "3204966b-b55d-4f5a-9013-63c87226e987", "comment": "Malware payload (AgentTesla)", "value": "612db60d42c16a5710b1c992d586601dc64abb91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891605, "uuid": "d25a2153-debe-4561-9419-b22f32b2a48f", "comment": "Malware payload (AgentTesla)", "value": "4a1f9602b775e63d4b5f4949e8601d8a7ca44cfe77437ee6794b76c6a5f9c6b15990278448b4622b371ced5b91804077", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891605, "uuid": "6ae22e4e-27ba-417a-a90b-55e047de1604", "value": "T1EB058EA337B194B3E78720B504247B886BF06613BE16E2D39BB736C067C5DB77298152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891605, "uuid": "89ecadfd-6fba-4c2b-8de4-f0be5bf19883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891605, "uuid": "3108240c-d3b5-476a-8ab9-bced5a822b9f", "value": "12288:+E/hefqqG4yPaKGGSKe4chCirn8MsNspUZM25F4vnKajJ06Fy2Mxzo3:1eiqG4yPaL3d2xnspUbyrJ06F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675891605, "uuid": "30aa1b42-d466-4e5c-8089-0c5ed5fe5ebd", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675891605, "uuid": "783fa246-f029-459e-9638-b3af5e2e78b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891605, "uuid": "e2e1a6b2-24aa-442e-b346-ce501278ab80", "value": "statement of accounts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba982228-a788-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675844120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844120, "uuid": "2a7d1b65-e923-4425-8731-b69e2163a38e", "comment": "Malware payload (GCleaner)", "value": "ff52b67b3f1aa2a4672c410448a0d871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844120, "uuid": "40974704-2b73-4e6b-92e4-091114af782e", "comment": "Malware payload (GCleaner)", "value": "9758cb1039bf16924c9865e92e981f0127b43a86925144c5857024105ca2b9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844120, "uuid": "130702f8-e2e6-4c80-990b-486e32ad5c1c", "comment": "Malware payload (GCleaner)", "value": "b014714589ba6d0515c048423cf410c3fb4738c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844120, "uuid": "6ee4809f-f61d-4c4c-8f98-7adb1663a53e", "comment": "Malware payload (GCleaner)", "value": "11fe25086869255f6ddc0d5e64300def90be485cd12a12a699da70477260a6b9bb90e3944901111390cd479409dde307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844120, "uuid": "4c25e9e5-e42b-4785-985c-fed50fb454f4", "value": "T1C8C5127C7505C4AED280BEB48C3AD5F71CE76DE3D9A0A52270D9BF3F52792885A09207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844120, "uuid": "3d1dc95f-595b-49b1-aa11-f87d79b8aa4d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844120, "uuid": "be0df0e3-9573-4d09-9b84-74bd9bfcee64", "value": "49152:rdHy4hd6nCI0/hXfoZpzEVHCpeS03Kz2KFiI0qaeoaqawUxZu8JkFyLCgv2MR:JHTz68XfeZEEpK1KoI0qvoaqawILiFat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844120, "uuid": "90e3bfc9-bc0f-40a5-8a9d-f31e12566b2b", "value": 2709293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844120, "uuid": "f04a93d1-7a6f-413d-a3e1-76bce172727e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844120, "uuid": "55993035-b43d-4afe-a819-8bafbadf0d7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f834c4-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885634, "uuid": "0c125769-07af-486e-b32f-ca5b59dab6c1", "comment": "Malware payload", "value": "e77733eaf39be4c0c617ca0d04de7e92", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885634, "uuid": "0f4ff867-d17f-4ecb-b352-1d5762eeb63f", "comment": "Malware payload", "value": "97b7c1f07a298273b65fd89ca73a0d9315b8e864df0dc8f71ea982151872a2ce", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885634, "uuid": "97101aa7-f136-4ef6-b94b-d389cae8872e", "comment": "Malware payload", "value": "ecfec5905eb8cad7e4bb2ab250eaf2e068762475", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885634, "uuid": "e697bd03-abba-4d15-a8c1-ea88345a5ea9", "comment": "Malware payload", "value": "f95d38e24c82ae9af79e7655ffe6ae414cc2b8bf07de1dc64aa873a60a024ff8fd414cf9ba209b70206ab294a9f91bd0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885634, "uuid": "7e3a7f94-d248-4441-bcec-1a6a6537670f", "value": "T1FD143271E5668CACD008933D60E65A715720DC190BA2A70B51BD7F5BEFF20606ACEF72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885634, "uuid": "57813df7-0d18-433f-876e-d1a84e9b86bf", "value": "6144:sxEtjPOtioVjDGUU1qfDlavx+c/UgLYrG4Hiestu:QsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885634, "uuid": "835c1d04-00a2-4f9e-ba50-c6d402837856", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885634, "uuid": "05b2cb1b-b975-4011-bb66-87445a050928", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885634, "uuid": "ee89d982-82d2-40c9-aac3-b452433d7076", "value": "97b7c1f07a298273b65fd89ca73a0d9315b8e864df0dc8f71ea982151872a2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b87758-a786-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675843063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843063, "uuid": "ab1a70cb-9c70-4c2c-adbd-77ce85947915", "comment": "Malware payload (Smoke Loader)", "value": "18582cddd52df257afbda34b15d23ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843063, "uuid": "4f500df9-bc68-4530-bbf6-f0ee2877a8c0", "comment": "Malware payload (Smoke Loader)", "value": "97cbef810fb6de96dd3bbe00939450adfae329e8818b50a52323ae942aaf612c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843063, "uuid": "bc63e5b0-8622-4c60-bd01-386549075452", "comment": "Malware payload (Smoke Loader)", "value": "558e142310368ad7a00957f45c86f8569ac60c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675843063, "uuid": "a33f04fd-f4b1-47e2-b133-6c6a36d68f8f", "comment": "Malware payload (Smoke Loader)", "value": "8f34c90379ee4d8ae0b8e7dbc00bb4c0be126d1083d67e8fb7d08317280e18a226e58d45f7706dd1ec3d614063cb8fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843063, "uuid": "c72ebef8-a790-416c-9651-30dfdce51030", "value": "T10D644B5393D17C48E9258B73DE1EC6E8F61DF590EE0B376B3218AA5F18B0076C663612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843063, "uuid": "8177d2b6-9a1e-4994-9fec-5f8ec0eae174", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843063, "uuid": "b90f7755-6556-4c75-9833-c91e1cc8fa79", "value": "3072:4wtq+1XewXR5WQJw/PeJYbwWnmBBo+dtPQGG+WByUAl1t8UFBWR:4kJ1uUWQu+ubwWnIqQPQGVWUjtTFIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675843063, "uuid": "3629396a-7464-4b71-b5f3-680b4347693c", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675843063, "uuid": "ff105221-761b-457a-9f6c-ab0e9e0c554d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675843063, "uuid": "f25c244a-0288-46e5-81d2-91a571f38885", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb2ea9c-a78c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675845793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845793, "uuid": "a58e6cc9-f8ed-4bae-9207-dbebf94faee6", "comment": "Malware payload (RedLineStealer)", "value": "fcd253afceb07b67ca144932b737fe30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845793, "uuid": "b18395e4-77af-441c-90eb-afb924c15c33", "comment": "Malware payload (RedLineStealer)", "value": "989a9f6c6fa0af5094aa4bd850d8ce5028502eb182bc4e5fb34707712ddfa610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845793, "uuid": "61c146f9-3da7-4dbf-ab85-0f7b646ebce2", "comment": "Malware payload (RedLineStealer)", "value": "1aa59341293f43562706a14e8ce951f1c10e894e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845793, "uuid": "64c98e8a-60df-4eac-889e-081acbaa0b0b", "comment": "Malware payload (RedLineStealer)", "value": "c3cde5cf3ed92d3faeb63b71935ad1e18a4af0e0abc5e23c07aa4d6dede242151b9d71c889a2fb92471e74746d7482b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845793, "uuid": "0e25bc8b-8278-4c47-a244-402019f8c8cb", "value": "T1B8C4121B9BE85132E8B657B059F702D30A367E605A3887A7334E6D6E1872570B372373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845793, "uuid": "a02ec658-d0cf-4f4a-b544-7ef72370856f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845793, "uuid": "cc36f281-6524-4619-9c33-c0cb22c8bf8b", "value": "12288:vMroy902zREv4psBYDZEDPK87dpXIj627456X+Prlc+L6XOaH077:3yxkSELK87/OZMxvLk0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845793, "uuid": "0ff8e7ed-961b-4f18-ae95-b9f0f507b034", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845793, "uuid": "95c81637-bfab-4db7-919f-6aa2de244d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845793, "uuid": "bd9c9521-1d33-4f41-8190-9856858bc04a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de80bbd1-a746-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675815834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815834, "uuid": "bbea39a5-6eac-4720-8e81-f9b143ee18e1", "comment": "Malware payload", "value": "626b82ff58e59c5b85bf5163fb10aaff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815834, "uuid": "585c81d6-e34c-4599-9da8-ac90600fb4a0", "comment": "Malware payload", "value": "992bb51a3117dbd10b23796464c3d71046ff45dc33282c053449b0baf1109e9c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815834, "uuid": "87237d70-fd19-4375-9081-3e5800eb9bb3", "comment": "Malware payload", "value": "7805b838555fd84b46ba52384cded06478e0ac60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815834, "uuid": "7de66132-f118-4eb7-85b2-2d12252d6b2a", "comment": "Malware payload", "value": "0bfbdab97097eb5874a6e3a62e6259e56ad1b93ae1ee164c2ac1e6967269b3827e42c24fd81f33f4ff8b37b4591b4884", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815834, "uuid": "b4f426bf-e744-42d4-b28d-2da8c2fd6e53", "value": "T1A523027D34175386AF42379063FC2D89B9C741DE8B686E4952EF336D6A0318CE76E281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815834, "uuid": "8bebd2d1-9e2c-4c36-b595-e704da2d32a3", "value": "768:DpujW1lcBzmEcfW11T81s/7BoKyERZmxUTMjFsEukSM7Kqh+rnGtm0JuWMo86I:N51l6SuL9oKy1x2Mj5/LOqh+TGtN4bos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815834, "uuid": "70d3b4ea-f588-4eed-b4bd-44c61481403b", "value": 48091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815834, "uuid": "1a9310bc-6b5d-49dc-b1d0-0899c413c748", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815834, "uuid": "b647bf98-60ef-401e-8272-8996686ef6a3", "value": "install.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628c3693-a7fe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675894653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894653, "uuid": "d51c62e3-e467-45ef-93db-15069ad5b538", "comment": "Malware payload", "value": "eb8ea59954abe9d3fe332328226d84ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894653, "uuid": "3436ea48-9672-45e6-968a-38560b4b1935", "comment": "Malware payload", "value": "993435f1debf42e6f00dafc6dc2284db7e3fdc7b7465ae44acb6cf1696ed488d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894653, "uuid": "41ff1478-9b1a-4456-8716-bde369acc59e", "comment": "Malware payload", "value": "d844181217d5425fed84084333b89a7d2d07a595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894653, "uuid": "a0b64935-ed05-468f-b9f9-76d8c1bbb015", "comment": "Malware payload", "value": "ab037315fb3a062000b54b786094b36318ea5f307e0c765f0b0c5826a8c8ec54ff95ea6aa508750eea20f768a20d1fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894653, "uuid": "fb6ea4ec-87ae-4ba4-90ae-d42570649ea8", "value": "T184642903D2E27C81FA258B769E1FFBE8764DF6608E4AB7753218DE2B14B0572C163611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894653, "uuid": "8309d3be-2b85-4374-a927-36f9dcb57e83", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894653, "uuid": "4a6361e6-c6fc-46c2-8c45-13ec10d28178", "value": "3072:uPgTsKw7n5RFUlJB+BAKfwWB2zns7PbHUfTxAPvn3ZVzsWQDiuLpZTkgvG:uXxdyJB+BAKbUns7jUmZVQLiqZNvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675894653, "uuid": "3acb8b2e-b8ab-41db-b0eb-2e2902b01694", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675894653, "uuid": "26437a57-37b3-4edf-93ba-a7d2d6960a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894653, "uuid": "28bebccd-1357-4c11-93dc-224935415401", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc1822c-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881409, "uuid": "a927787f-52e3-4128-9d39-c1368c43906f", "comment": "Malware payload", "value": "a4dcb8dc89a5e3c6a772887d58969cf3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881409, "uuid": "27d3f645-d907-4660-8bbc-253b8dd318e0", "comment": "Malware payload", "value": "99575c40eb6df85130e56b622b7c1fa58f20d821e404363af7cbf14c501cf8de", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881409, "uuid": "855def55-c07f-4d4e-bad0-f30941b66529", "comment": "Malware payload", "value": "f877b98285c2f903fe7dbbe074d81d213bb1355f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881409, "uuid": "a3af2a53-edd6-4960-9820-27ce7018e6a8", "comment": "Malware payload", "value": "c9a8cb9686b05bd8581061058dcfa1cebaf3c6cd5a8ce7e851e5ba41084e2d8615aa57861208efce63408eb63601a00a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881409, "uuid": "2650ceb9-917b-44c3-8d93-1561a1f39741", "value": "T10A35F007F273ED2BDE23C57CE88F148282169D39A915C64E21C3B32E5632BB1597EE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881409, "uuid": "8ef956c1-9bc7-40ad-b12f-964fb775a74d", "value": "24576:1Feruw6ZpvFenMbvTnCWnYGFEG3dRseW:nnw8pNlbvT1FEOdRsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881409, "uuid": "383bfba9-a84f-4cae-b2f5-341cef8d48e3", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881409, "uuid": "337c6f9b-dc02-4272-b4ce-4fafc89c3e49", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881409, "uuid": "e6dcf175-4c20-42f8-bd04-26b209c6a58c", "value": "COF2023027634.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44141b21-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1675867973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867973, "uuid": "090d57a9-fcc8-4d49-9319-cadfc81599a6", "comment": "Malware payload (Heodo)", "value": "9b82f37e58f9bb27d2a7dd96e9e2f702", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867973, "uuid": "5eef19f7-f8ba-401f-b984-ed063972f075", "comment": "Malware payload (Heodo)", "value": "99dab8b3093e77419cff4a3e64045b972f1152812a69332ad88da1aaad56485e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867973, "uuid": "2544bb43-850b-4313-9840-432df9e060e7", "comment": "Malware payload (Heodo)", "value": "d8c507b86e9843594169e4cbcccd9a35c1f97d60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867973, "uuid": "f0a8282e-fbb7-45c9-8c25-29885dde8e7b", "comment": "Malware payload (Heodo)", "value": "d79e75f48c91e8e026ef628571717d5cc73ef6e1dd665cf27d18a3d885274eaabc9c1e1a2716e819660e891f3466e21a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867973, "uuid": "d86d59b6-09db-484b-a8d6-d87e82d02d94", "value": "T1ABD4AE19FAA484B5D06BD139C6B28A46E7B134DC5B7143C793A5871E2F336E06E3E360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867973, "uuid": "8ecaa569-621e-43c0-b74f-9385fb9ba6f7", "value": "1928823fd02fe064f4ca976b33bd8937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867973, "uuid": "e8027e67-fc58-49ca-84c9-b24ff9a4c614", "value": "12288:nsuLrr8h7qGMufOWhNkdgF8h3UHHdM/tQ3W:n5/q7qGMufdhNtF8SH9M/tQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867973, "uuid": "509ee8d9-f423-42f9-a919-63c85cfb072b", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867973, "uuid": "431a92e9-bf09-434d-be54-fae8d5a71061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867973, "uuid": "d4a7fe67-d0c0-4fcb-a4a4-3e6d37f48908", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768080f3-a77c-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675838852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838852, "uuid": "c7ed784b-7c9a-47fc-bd28-437f607ec65d", "comment": "Malware payload (VectorStealer)", "value": "39e8526faff6cf353f1fc6dc474c5eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838852, "uuid": "557b79bc-9415-4c74-90ad-c7a050e84ed8", "comment": "Malware payload (VectorStealer)", "value": "9a1ae8544444f38b8144c8cb273299b9eb6cc713cbbadba239781a93cc4637b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838852, "uuid": "65efa641-3d32-4227-a096-0d586e4b6e8f", "comment": "Malware payload (VectorStealer)", "value": "a8e4c50fd5bf890c34b979a6741acf43d66975fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838852, "uuid": "6f8ef89c-bf0b-459f-b5ed-a8143c98d6ac", "comment": "Malware payload (VectorStealer)", "value": "cf599a26e1fb5b907481f1781a38ff48e4d5938afff4500e1c6f6e21b84a7b66684632e403f4d9d7701d67aad83bbefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838852, "uuid": "7007158a-0578-482f-ac86-42fe94a65b3a", "value": "T16255336A3E66C42BFDDE6132503DA9535BE111724AC8864247B49E0E7D3EE438EF3790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838852, "uuid": "bb214918-2230-459a-beab-6108bf5203ff", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838852, "uuid": "df742a8d-1766-4f82-9c3a-3f8f6a9ebe4b", "value": "24576:/YxXcQpG57JEFsC2vjZExaBRx7Yq++utrYcigJbHck78EuBwjNk+tiBnI/6kH:AWQI57JgsF9ExaBRxkqyizEuBwjNk+tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838852, "uuid": "e6148144-8856-4891-8e80-7c8f0bb8012b", "value": 1326923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838852, "uuid": "28cbb93f-7da1-42ef-8250-54564bc76c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838852, "uuid": "fd1a75de-4658-4f71-9d60-7064287ca235", "value": "IALTNT22021-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2b3d31-a7f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890970, "uuid": "63e7ebf5-3f62-4a43-b8dc-891cfbb32a1f", "comment": "Malware payload", "value": "33edb3a0eef583fb81fe2e2db031c9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890970, "uuid": "04f0dad8-8925-4cf0-a742-dbac27a926cc", "comment": "Malware payload", "value": "9a9f09cbbbc6a96da3027b94c5dafee100865045c619465193a835c9a562e504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890970, "uuid": "5b255470-1020-447c-8184-e48372295440", "comment": "Malware payload", "value": "d74e271d771f084a1dbff66090762a4c952f5304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890970, "uuid": "2b8d18d9-41a5-4cb3-888d-58345acccbcf", "comment": "Malware payload", "value": "0768b6bf6542247a4994035f95b8d838ba698359ed107f1fe58a863dad3886cbfa88921bf150c274029d9369e113d89f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890970, "uuid": "204c626d-acac-41ab-8897-23c0f990740a", "value": "T1BDC5123D7142C46CC680FEB48C3AD8E71DDA6DE3E9E4A06270D87F3F52791899A1A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890970, "uuid": "7a802554-cc27-4a82-8a54-2695ea00d4c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890970, "uuid": "fac6431b-bd14-49e6-a338-f965d561353a", "value": "49152:rdH9m2M2lqiBgs/c1nCYUWwu4XJRtYGZvrZcaO6Mq6LCgv2MR:JH0esgcK1nXVu7qSv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890970, "uuid": "4c513cc2-da92-40a5-8a95-49220cf92b24", "value": 2702582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890970, "uuid": "9d096847-b92a-478e-acb4-221ce50d26d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890970, "uuid": "0e09e732-84b2-4a08-ba6b-61827768f369", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40921609-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675819864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819864, "uuid": "16063544-f379-44a0-b09d-6a48aba85371", "comment": "Malware payload (LaplasClipper)", "value": "0a36af6655f76fdd5dc78ebbf85e2752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819864, "uuid": "ad7e112a-0cef-48fa-ad8f-4c28e9c626e7", "comment": "Malware payload (LaplasClipper)", "value": "9b3a50dc10eb0e67144d29b43b6be6ef932b4d3486659e5c699e72a82b063dd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819864, "uuid": "b4446dbb-3a99-4b3a-89a9-1a1486249388", "comment": "Malware payload (LaplasClipper)", "value": "79ad61776ec50945c1ab27bf434a8c0632003a1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819864, "uuid": "28764488-f9f8-4778-ad3f-bcc55d4864c8", "comment": "Malware payload (LaplasClipper)", "value": "d183dafc6de26b573c8ca57b7cdd4b50154757f6db6451e19fead0374f3f4bef541ed8eca24507cc5ea6493e06c85e92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819864, "uuid": "a04a8b44-9b8c-4614-941f-9828626ec88e", "value": "T13616F06581C430FFCDC4DAF746F5AF4F257634731602AA0FA48EF289892A9F8AC07565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819864, "uuid": "4d7fd45e-a14f-4294-a563-c2ae5a55db74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819864, "uuid": "8a881d37-b4e5-4154-86ef-914d29f55c1a", "value": "49152:Q0vYGL/PdGnWYzlXaDSvcDNPZSUO59aukb57R2v2brVZM18s2916dBK7SkBYHMqr:Pvb/PW3lWI4pjy9aTR42b7iA5aMuxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819864, "uuid": "5edb837d-7fdd-4417-9dba-adff563790cb", "value": 4297216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819864, "uuid": "7403d908-8042-4a32-9537-22dba496764b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819864, "uuid": "00a5d76b-85ae-4e48-aa8f-87315ae9d914", "value": "0a36af6655f76fdd5dc78ebbf85e2752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3abd79-a7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675866373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866373, "uuid": "758a4a04-6560-4f98-9cbe-778957bbfec7", "comment": "Malware payload (AgentTesla)", "value": "0fba3624c37c7fdc6114da8953957cdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866373, "uuid": "6a9c5ea7-345d-408c-8476-ae7062ae1364", "comment": "Malware payload (AgentTesla)", "value": "9b5c3c9ea67248603ff93f97602bb0edcd66d702b00c3d08566528e3acdf073e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866373, "uuid": "46ea6f7a-851a-4908-bf34-951b481b07ef", "comment": "Malware payload (AgentTesla)", "value": "398be64a0d6a03c814f43585e31717517d055384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866373, "uuid": "67202d2a-481d-4cf0-9ce0-4618821c89fc", "comment": "Malware payload (AgentTesla)", "value": "a1d866dd59a1908644927c6a612b1c2501213d26bb9cf9e0df0510962bfec760f58f13b3132c9ddd020d95f6643e385f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866373, "uuid": "c3289da8-3065-44f3-a96d-f3c06381f550", "value": "T1E064129876E5981AD6F207330D7793906FD6B42732219E8F07C09F09B974782EA1E736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866373, "uuid": "c906237c-b81a-496a-9b7a-a38125916c9b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866373, "uuid": "60728d64-3c72-4738-8687-f45ba8ea8730", "value": "6144:vYa6J/CbqebyHfYlusr/AlQWIE4yoDH2bhU6k+PSYwB6KDgAWY6U8Koybk5kp4:vYbNW8fYbAQWJFoqslBNcY6USBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866373, "uuid": "d80a2e28-63fc-4513-9e3a-b7f754c8aad4", "value": 335443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866373, "uuid": "934574fa-cd88-4404-bb8e-7671f9a9cd1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866373, "uuid": "4348a4d5-dabe-45fb-876f-b6bf4dcac98b", "value": "DSG2011001_INVPL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0291a4a-a7c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675871268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871268, "uuid": "4aa66e19-3e93-4bc9-8f57-15200fad3d3f", "comment": "Malware payload (Amadey)", "value": "08b2ffbc9b20178dd42308e8d1173292", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871268, "uuid": "0c90983a-6ecf-42dc-bbd3-e7878f6dd6c6", "comment": "Malware payload (Amadey)", "value": "9b7d04a2dc098ac9aaa4f24a82939264a5fc84eca469fa80c4f182d82a30c9b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871268, "uuid": "be313e53-5692-4009-9ac7-e38fb9f48b5f", "comment": "Malware payload (Amadey)", "value": "2c9db57659eac479b7520d3864d5c8a6ebdcc307", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675871268, "uuid": "4805d5d7-2942-4f9b-95b2-b13ccc96fcdb", "comment": "Malware payload (Amadey)", "value": "d0b4665fd8c6a70be4f9237433c4ae07c1851cbcc98b6838a5ec36347829eecb6e2abf44df601e53a863c19b998bbda9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871268, "uuid": "1968f9ff-b87a-4e52-a4cd-f9bc9e337fac", "value": "T1F7C40207A2D88835D9F567B019FA03C31A36BD615A74C39A735E6D1E1CF22B4B232367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871268, "uuid": "e002d9eb-6819-40ed-9b13-bd2d2f159f2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871268, "uuid": "ebe33e7f-424b-484f-b1c1-2453c5c8d877", "value": "12288:gMrKy905osAZHGlnmCTTKxY/XuzaHC0qoraZmCRBFzyM:aygAmlmCyxkKKqor1u+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675871268, "uuid": "a878b563-f1f0-4927-840b-d08b3ad1e722", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675871268, "uuid": "dbe65ac1-f59d-4f49-a39b-9170b3357eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675871268, "uuid": "4996bec3-df1a-4193-bd8a-1e31925e5761", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c7676a-a792-11ed-88f6-42010a9c006e", "comment": "Malware payload (Bayrob)", "timestamp": 1675848305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848305, "uuid": "c4ade52f-dc72-422b-adb9-74c2fef44f3a", "comment": "Malware payload (Bayrob)", "value": "3034cab2f9ef0005b30b331b98e05826", "object_relation": "md5", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848305, "uuid": "33cd4da2-ca4b-459f-9679-da5262d1c0d4", "comment": "Malware payload (Bayrob)", "value": "9ba82c9d5419475b98fcb762622d3e89b62a51154bb6e07299a1ccaae6b808ea", "object_relation": "sha256", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848305, "uuid": "90d0cbb0-e718-4923-9d7f-ac15bc9516a5", "comment": "Malware payload (Bayrob)", "value": "0cc24a8749ab995424e443025340b04587502c56", "object_relation": "sha1", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675848305, "uuid": "5063e50a-9d0d-4b22-895b-880964455549", "comment": "Malware payload (Bayrob)", "value": "4b2ce5b865c8ffe083773df63f218674ca574441aafcaad00bd7d47b4c9f49fc02a58a9f887da0ea451d7f2ceab8cb99", "object_relation": "sha3-384", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848305, "uuid": "19733607-a668-43f2-9aa5-e9a8403e195c", "value": "T123B49D01BB05B362D86055F07B6BD2B2357BBA79473A0CD7F782C92E8A660F03635752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848305, "uuid": "30716a2c-a433-4f4a-a193-72f98c3b66df", "value": "41816fd96dbd2f32317f48002a65ec72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848305, "uuid": "18d985c4-664f-40f9-9983-fb4f7e9b3388", "value": "12288:h2mTzBnGvkXmJ/ZLxTRj4ndBl/zQwOaYDTyPXNGKIEF:PNndCBpydseYqPNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675848305, "uuid": "8dd534b1-838b-4271-aefb-75420cc3ebc1", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675848305, "uuid": "1383bb4d-0b2b-4115-a6e2-a9079bbb53f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675848305, "uuid": "0199863e-82b0-4a23-b535-3782f88a1330", "value": "9ba82c9d5419475b98fcb762622d3e89b62a51154bb6e07299a1ccaae6b808ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0c29f1-a7ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675873917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873917, "uuid": "98f9ae0b-c8a3-4fa9-a43b-9875d18782e1", "comment": "Malware payload (GCleaner)", "value": "2e6b7d1c2dc670290df6fb66d118730f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873917, "uuid": "925d4171-62ff-438c-af35-6be46c4424ed", "comment": "Malware payload (GCleaner)", "value": "9bca5fe5ffef46b2e4681ae4a7346779b0e20a8fb08db4af9b4e6b7f43fea053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873917, "uuid": "bae82542-9947-4b33-b00a-fe854a336d8b", "comment": "Malware payload (GCleaner)", "value": "1e831735a062c2e1679aa8d831c13a40961a7db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675873917, "uuid": "8686726f-35f3-4c6c-83b2-49ce09ef80df", "comment": "Malware payload (GCleaner)", "value": "f56c0c109da03ad1281f2bed5a8acff8e02501fd1716e7b097dd66319bbebbdf0b4921ecdeba929086b25fbdc6ee632f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873917, "uuid": "ef0b74f4-4de9-468d-b548-fe22c3e3acdd", "value": "T141C5127C7111C5ACC680FEB48D3A99E75CD66EE3E8E4A06270C97F3F957D1898A19203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873917, "uuid": "0652f3c4-17e5-4002-bc35-682dc5407813", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873917, "uuid": "20bfbc7e-16b0-4f4d-a39c-60f2884ed259", "value": "49152:rdHsY1AG510sgSSf8cPj63KDE3aHU2u2+oY77wEINH8B/LCgv2MR:JHseAG510sgSHcPqKo2reu8Bbv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675873917, "uuid": "0facdf5a-4be6-42e0-a95a-8a2673bbc14a", "value": 2713427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675873917, "uuid": "6b9bbece-884e-4e70-af07-4e92c83cdc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675873917, "uuid": "1bded3e2-1887-46df-9eac-d72ee40ed61e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214ec9cc-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675867915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "47fa6e3d-7b52-4ad6-a5d5-64fa383fbea1", "comment": "Malware payload (Formbook)", "value": "5c0b67024b247770c698bf31b9c13aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "a7c322ec-32ce-4fd7-a021-83c24dc7c73e", "comment": "Malware payload (Formbook)", "value": "9bf9df50e3c13a87226b9f9099b510947a3f8f0903b84bcfc39a625ba3342a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "8453a6a2-f5e0-419c-b2f8-dab0c6c23db5", "comment": "Malware payload (Formbook)", "value": "cf01b7072683c8de9e9cffbf26bc5cb582e1b8bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867915, "uuid": "192c7924-a866-4bbc-8812-2a631244b61c", "comment": "Malware payload (Formbook)", "value": "6fd02481a4b1d41e83b5970769b74122fb61c5b6b1fbeb94eef7e0db79621dd1ee5101d2034e7ae9f0ef12baa805af2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "79231e38-e38d-41a8-8302-4c4d944f6409", "value": "T12D64235062E4C0E3E9E36A721E7A85B54BF0FE7914B1C51727A09B04BD39320FC2EB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "59510bec-f49c-436c-82b0-228f7263764e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "2fa1eeff-be9d-4e97-b649-ff443b6644af", "value": "6144:lYa6mAtsDVxvDl1lOjmBHmc3eukmjvVttfFeffWNgsNAAvTBr++/b:lY8AteV3nO6mc3tjvd8fWNjTByyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867915, "uuid": "9a67c6bc-6dc6-468f-aaaa-c270d813eed0", "value": 306839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867915, "uuid": "96c0976f-5533-4a55-83dc-46bed1203318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867915, "uuid": "de704e82-e274-4c24-96b3-3ec60b690ed8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b0822e-a7f7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675891697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891697, "uuid": "46279eba-3484-4b37-aa6e-26fa9f75f981", "comment": "Malware payload", "value": "87f6a5f42edeebe705a5112c052bc7e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891697, "uuid": "47b6cb31-00a4-4056-8f2c-e28af2ede985", "comment": "Malware payload", "value": "9c31f5ab8d64f1b2050dc91ce4f1c1e7d776409d084f433ed2a7469ea2449532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891697, "uuid": "56e76daf-b0f4-4ee9-bfb3-8a64f2870d34", "comment": "Malware payload", "value": "fbc9d52043ea51139d7110c2a9a52633dddf6da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675891697, "uuid": "3e331bbc-08e1-4cfb-8ffc-33d010d6973f", "comment": "Malware payload", "value": "310d167f9b85915f8a4a6b73d6cc6e7f6e9f4e094cf35c57a7606443886c99e95129bf5e0e4d20fe9d47cc224b9a6105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891697, "uuid": "6d9c2dfc-2e14-49e4-97ef-4fd590a56256", "value": "T1DBC40243EBE98022E4B557B01EF203D30632BD656B38876B678E9D590C73674727236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891697, "uuid": "8a1a2301-0105-4700-ae63-880e52ede73e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891697, "uuid": "7bd25904-b9bf-4d43-b81f-97a8eb3ef7fd", "value": "12288:GMr1y90ylfRWhbD/7IWTPTKHEt22r9SD0igZGPBhIySLXQbSXPXV:byPl8hbD/7dDRt2NBhK4S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675891697, "uuid": "99f839b4-7836-43d4-913b-c9b3b2855be1", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675891697, "uuid": "03f6ad3e-1dd9-47ff-8df6-5b61131440e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675891697, "uuid": "87d4b3d8-e225-4c10-8f25-bb683d183df7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd799f6-a770-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675833928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833928, "uuid": "b4f0810a-0d43-4f7b-bb9b-31cc2d56639f", "comment": "Malware payload (Amadey)", "value": "d2c7f10eb1b82bdda4ec935b225ca0be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833928, "uuid": "e73aa4d6-8134-4b35-8ad3-b934f6b10b41", "comment": "Malware payload (Amadey)", "value": "9c46c158a2e5589f4464d275a6d6ac6e1558f0412c2ae650780861358c04e84e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833928, "uuid": "788f1279-1d37-448d-8075-448f775275ab", "comment": "Malware payload (Amadey)", "value": "24f94c7e52f5b23fa2d6df15ae3531568fce535b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675833928, "uuid": "ff56aca9-21aa-48ef-afe6-3cdb41ad8a78", "comment": "Malware payload (Amadey)", "value": "b21fcc3d1e58ab1b8220f2b5ff70c09dee2a0f0a9424f9ba27d6e9452ddddd42ef9ad9a1694075af4c462795f330a1ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833928, "uuid": "87572737-5f05-4ebb-9244-201c7546fedb", "value": "T18CB4020BB2DD8071E87853B019F707D31A35BDA11A78829B374E6D592CB36A4A73137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833928, "uuid": "6fb78f0f-2149-44db-ad9b-dae5a48a0b63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833928, "uuid": "4564f696-fdbc-4d61-9640-7b36ba630fbc", "value": "6144:Kvy+bnr+6p0yN90QE8zhkbv8tMIjOFu4To5GkJOo6dazSjx/HGJmUcyBsCCFFa6i:FMray90xv+C9sOoc6mx8mUc2EpFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675833928, "uuid": "6dbcb981-2ab6-4d3e-a039-35878bcd39e7", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675833928, "uuid": "19b32a97-754e-42fa-8d99-1bfce0f6b679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675833928, "uuid": "f45730ad-b139-4b67-aa4e-de414b6b89a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e573865-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675867883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867883, "uuid": "2d445f09-c465-43f1-a218-2a5141a0115b", "comment": "Malware payload (AgentTesla)", "value": "f91184e4fb4731a954ad7b4dcbdd27ea", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867883, "uuid": "70a92dd6-f77f-445b-9c41-5560b8633cdc", "comment": "Malware payload (AgentTesla)", "value": "9d0fb9d6796d5c4b7a15099b64d749363237b452e83a888cbfa5b4b48f2b1904", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867883, "uuid": "434a6466-5863-4d38-a13d-48d7a7ddba3d", "comment": "Malware payload (AgentTesla)", "value": "ca85e4eee8b109dd694ba318b1ff26d59ea7c9b9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867883, "uuid": "abdcf718-4fd6-4d2b-9c4e-041a384adb43", "comment": "Malware payload (AgentTesla)", "value": "7ecd5c7709bfd99b75980e9e5e54db71d39c006f911f7a6d3b5f0fa57e541c12e5abba16ad597258855dcdc92174aa5f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867883, "uuid": "1bb623b3-8eb6-47b2-bf6b-7cc88e7d0b34", "value": "T138B42321FBE02EE6A6D17B4D9E91835BC0605F90B7108D147FABDC8B8701D4A9F147EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867883, "uuid": "482b0b0a-c2b2-460d-b737-3615836e9c69", "value": "12288:At8qifSB+DOew0o5quSMf7DS9n4/HUqW7CN/48K:UMS6OiM69oU9C3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867883, "uuid": "1f78a4b2-a107-4bdc-a81d-f10cf0065082", "value": 494337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867883, "uuid": "64403501-3375-43bc-9790-4a52833bce28", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867883, "uuid": "89537614-04f7-4ae8-bfef-e08fe8faa0ce", "value": "Invoice for part shipped 00875122.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b0600d-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881423, "uuid": "ee67fbb1-bb14-49b0-9392-6ec9056604a5", "comment": "Malware payload", "value": "16f65a65c5308ad13f1f145044e15e5e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881423, "uuid": "9f5aa5a9-dda3-4c7f-a658-30070eb0988d", "comment": "Malware payload", "value": "9d1689d8abadacc148c6f7c60ee0f45a82bd42a71d61a28c77262418dd23cee7", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881423, "uuid": "4818b300-5850-4399-9ae0-0cb15b27f97f", "comment": "Malware payload", "value": "6b27042de64ae9becbb9bb8908dd856883a5e8cc", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881423, "uuid": "da61bdee-5fa6-4dad-81da-7d88198a0810", "comment": "Malware payload", "value": "7b76e2bd7179d06503dd3f7ba797cd23f72ea0d5e6a12be849a7449caf183beb9bceab4581f5a4b3f867161f0d69166c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881423, "uuid": "b2027f8b-74d5-4d66-be57-53b949438770", "value": "T16635F107E579ED2ADC22C53CEC8F24928212AC7AB809CA0D21D3772E97327F5593ED55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881423, "uuid": "ccc0df47-493d-42c6-b455-6dcf7dbd8bb5", "value": "24576:8FeHs5hwrCFemUMdQ14SKdbIZkO+PH3vvwdf:guW8CpUdn5Zx+Pmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881423, "uuid": "036d6ba5-810e-49e7-a50c-2c498ad45741", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881423, "uuid": "d5bb5af4-3ffb-45f1-b312-9ea7f90ca649", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881423, "uuid": "260239c9-71b3-4cb5-9b07-77a2000e91da", "value": "Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffa6541-a790-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675847565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847565, "uuid": "11bc5b9e-e724-418c-82f9-acc73599ebad", "comment": "Malware payload", "value": "7ff5aed9f3fd2967586674ba1fa26128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847565, "uuid": "ed0eaa2d-0aa0-4405-9c26-3fefc3bbb05f", "comment": "Malware payload", "value": "9d24367876a6e4d3ea134e789f837e0c213b34c6a316daddcf6f01a1e7e42174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847565, "uuid": "ae962cf2-e97a-4c71-b558-794e5b6fc99e", "comment": "Malware payload", "value": "eea16437d78936727d853db1bbadd8cfc522e647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675847565, "uuid": "6aca3259-23a9-45de-8d05-b1fc04567082", "comment": "Malware payload", "value": "74714d07093b7549c148ede47da84d413ea45b7bba469141f65e5ee6f8bbc3c175baa6beda5b6a5b394f9958c3987c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847565, "uuid": "0c2910ee-56c5-4e00-b92f-978460b687d2", "value": "T138833B07F5D2A8B1E43606325874DD619E2FF9115BA5DEAB3785123A0F301C28D3BDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847565, "uuid": "be43eea1-5016-43a7-aeec-0c1dc0338a5a", "value": "6edb66eb85bfec35c16fc9e472a90635", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847565, "uuid": "73544b87-7667-4179-a478-f5d022c58b21", "value": "1536:ihRI7orKw9VSBLc2+fw0aqPTo2Wv6JqvQSyODZEYRXHsWsh/P2cdxgv/eER/RJ:iTI7A1VS9c2+fw0JWv6JqvdyOdRuhX3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675847565, "uuid": "0ad324e3-0f56-488e-9fbd-ef3d2b01b6d6", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675847565, "uuid": "24832283-6383-4313-b2cf-aa5ecc6d1955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675847565, "uuid": "44614230-bf3b-4d0d-b880-25900d3ab780", "value": "9d24367876a6e4d3ea134e789f837e0c213b34c6a316daddcf6f01a1e7e42174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91540967-a757-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675823006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823006, "uuid": "e7ef76d7-98fc-4842-93df-d6653c4a9ec6", "comment": "Malware payload (Amadey)", "value": "8e5250757680a898ec1326e7687fc3d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823006, "uuid": "5d65334c-c43e-41bd-bc46-5c1eeb1bec5f", "comment": "Malware payload (Amadey)", "value": "9e2c04b75b426f01df926763c5ece69da2dff34a12262fd579b6af60c1c0e404", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823006, "uuid": "78ba4748-88b9-4ec1-92e0-733f3910c673", "comment": "Malware payload (Amadey)", "value": "547216b00a3428d47aa1571f1b00a0d6a8b08963", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823006, "uuid": "fee944f8-c7ff-4fc7-8384-eb6f101e3cb4", "comment": "Malware payload (Amadey)", "value": "aebe550ba1727b9010b1a304563d080438f4f5bd6171050ff8fc0ac7d18526faa7267068c399e95b92f51aab26d07d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823006, "uuid": "fb97992a-a8d4-478c-a10c-cda73d5985d5", "value": "T15CB40207A7FC8536D8F553B019F612D30B36BD605E38839B134BAD5A18B32A9E235727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823006, "uuid": "94750081-af90-4bae-ba01-32331a5e5462", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823006, "uuid": "7291556e-d23c-4ded-ba79-b2d8f832d153", "value": "6144:K2y+bnr+jp0yN90QELGVpS6LV8fIeWVrodhYcKgFBpn5EcduDB/82Y+q7CCrZA8/:yMrLy90tGC6LDew0HrxaIPCe4e7ZgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823006, "uuid": "0e954728-1d6d-45df-9409-65611446cddd", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823006, "uuid": "7b1d86a2-cf19-4005-b0a3-9a7b57cf292e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823006, "uuid": "7b1e97f8-accf-49bc-8e6e-e6f3953deef1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10df04a9-a7fe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675894516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894516, "uuid": "7b2ab7dd-aed1-4197-ad6e-c5c27151cf1a", "comment": "Malware payload", "value": "3e745093134262e49c88d76e8d4fc359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894516, "uuid": "b240875c-c0af-48de-8157-64bfd96edd83", "comment": "Malware payload", "value": "9e5acae6123fb3e5abc2b3b8238d500510a8f65e711e3d2135f5b662dd25ad56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894516, "uuid": "c17d00d0-4ff6-4db8-8fd3-a29015bcb725", "comment": "Malware payload", "value": "134e01b72af4887f562418df9c1a2573c642e81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894516, "uuid": "bac0ffa8-2821-41a6-9d8c-3b886c949903", "comment": "Malware payload", "value": "54946550cb958b846b61926362c42bc9b91a0510fbd2d11351c46bca0e083afe9f59073cd6d1f900d09a3a6bd6f4802d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894516, "uuid": "db5e6fc9-71b1-431b-8811-fb343710485b", "value": "T178C41207F6FC4023D9B497B019F642D31B35BDA06B394366274BBC5E08B26B4A23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894516, "uuid": "bbb61286-59cd-44c3-9eea-05163220e9bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894516, "uuid": "8405a212-5d51-4351-854e-2cd8fcc9780e", "value": "12288:nMrRy90SJHzo4rCVB/YCj1+koqhgNoOXi0NA3KNJw:Cy64A9N1+kbmWyicJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675894516, "uuid": "8d1049d6-b670-4701-860c-b9b50dd50e21", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675894516, "uuid": "f7aecf6b-a28c-4b63-935e-8fd6ebdbf5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894516, "uuid": "fab8500d-51fe-4cf7-be23-59adc6a121de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183028e9-a7ff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675894958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894958, "uuid": "1bc2199e-e4f6-43de-820d-825a6ead92ff", "comment": "Malware payload", "value": "514ebc3ec800574ba4344432292dc612", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894958, "uuid": "ca77fbf5-df16-47e6-8bde-19b5d086e98a", "comment": "Malware payload", "value": "9e68ac920bae102ccf1829ae8b8c212cc3046dd82114966c74e740df68b76fcd", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894958, "uuid": "8efea0d1-7965-43e1-a06c-2a9d364d6c99", "comment": "Malware payload", "value": "d55602de4bf58e1f8f06f2cc225e73310689ef40", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894958, "uuid": "86ce3761-975b-4352-802c-4ec7c6490b15", "comment": "Malware payload", "value": "f996f005ca8694e3cc9a14198dc46a844d5c84414a911af561714c68367be66cfaeb104f2dfb93f219f363cf3c5f95c5", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894958, "uuid": "34cbf241-755a-4ba0-8916-e3ee81b973b1", "value": "T180F4BD08FBB442F6D02FD979C5A2820BEB71789C477053CB4244DA2E6E3BAE06D39355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894958, "uuid": "a442222c-87ca-4f65-905b-c654e0643785", "value": "6f667d7b96970d77a335e299d210ede7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894958, "uuid": "84ff05ae-1403-4a84-879d-962226d1d7c5", "value": "12288:ahAo0YrQzt0zmv02PZDjzYrkhvSXL5ACw9:av5sz6zmv02PdpaL5AV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675894958, "uuid": "9e8e8f33-c581-4e95-8028-0783b4e4759a", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675894958, "uuid": "8fcc65fe-90dd-448a-9dcd-0ac7b25aae0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894958, "uuid": "96a21015-752b-4d5f-a8d6-1dbe1cfd1969", "value": "si.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67becaf8-a750-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675819929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819929, "uuid": "63027452-65b9-4957-9e16-d6ed5a50673c", "comment": "Malware payload (DCRat)", "value": "df7f295abf012a89fcf8b6e311307712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819929, "uuid": "cd606f68-a840-498f-878d-45eee1733660", "comment": "Malware payload (DCRat)", "value": "9ea4906fae4be9bd79a6f41f0c5d8c32c4b6dd36140936b18739ee8e52c3c487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819929, "uuid": "60ec2be4-1197-437c-beff-bf1bac13fb9a", "comment": "Malware payload (DCRat)", "value": "3dae32b4a2121aaa0d45e9bca929a6e4571bfdb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819929, "uuid": "0526192d-1f21-4593-8649-7f1d1a365846", "comment": "Malware payload (DCRat)", "value": "80e470146dcbc4c0ef50fb575bc8e9c2816ebeb5c3c98827280f19a497cd7e50f95bbdc6eb7ec1a39858a0e49f01c4df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819929, "uuid": "85a2d677-5117-4d64-bfd0-5887a0889776", "value": "T103B5CF027E84CE21F0181633C6EF494847B4A9112AB6E71B7EBA377E55123937D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819929, "uuid": "e2f34d04-8c9c-4e3e-8e3a-6f96f61a8d1c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819929, "uuid": "b8110bd9-2d40-40bb-9529-5816637c95f6", "value": "49152:jbA3cS1QXL1FIbkpxf7CgKaOK5vhT1et0J/TFi:jb+1QhYMf/XeCtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819929, "uuid": "b927d8e7-647a-4790-8032-8bd88c27e94a", "value": 2434820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819929, "uuid": "344379ba-e4d4-4538-9e52-eda1be1368b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819929, "uuid": "5a862906-4c6a-4ec0-80c2-e4c3f1d4a3bb", "value": "df7f295abf012a89fcf8b6e311307712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f0892-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880931, "uuid": "4b2419fd-1eeb-4944-acd0-6292aa4c2343", "comment": "Malware payload (SnakeKeylogger)", "value": "e6a3824b28ef184b23ccca2f28dca151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880931, "uuid": "7488a830-b181-4d91-87c2-be663768e901", "comment": "Malware payload (SnakeKeylogger)", "value": "9eb40372237691f70f98fd3b46e040131d0e1144e62a79ce3709f4ed786907e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880931, "uuid": "dbebeed8-7885-4f92-a0f0-f91772aa61af", "comment": "Malware payload (SnakeKeylogger)", "value": "b6bd15342f2842f7a27b96fced186c3fbe003daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880931, "uuid": "52e945d8-a3e4-47bd-8241-f29833e89894", "comment": "Malware payload (SnakeKeylogger)", "value": "43f965637f5c7a629b8f7423c7022d11803db4e4ea60288508cb35b11e5bc6b5f7810c99bbdb30dd0231039c09d96918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880931, "uuid": "7df4d71e-98aa-4980-afee-87e06ce8d20a", "value": "T1B935A6243AEE501EF2B3AF7A9EE475879EAFFA73660694482054034A0B13B41DDD153F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880931, "uuid": "86fd0879-bdb1-4145-a8a3-89892b9d4ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880931, "uuid": "81a25b5b-08f0-452c-a070-7d2331aadb53", "value": "12288:1DdNuif+9gLHHPrpg6+R4cSbEX7ULxMtwprXauFRovStpBmfYx58QVC6gnu5242H:HNuiWGLHHPrpg6+R4K9gpgwoTnjBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880931, "uuid": "a41a6183-fda7-416e-9a3d-09fc9dd8e6b7", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880931, "uuid": "2d96f990-670b-4a5a-bdca-76128a793b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880931, "uuid": "774c9bad-355e-4ba0-b7b8-3ed27294244c", "value": "INV 002000-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c20c35-a7d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675878925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878925, "uuid": "397e8e1c-1bef-4e6d-bf67-3dafd623374e", "comment": "Malware payload (Amadey)", "value": "ec28633086aaaa60e61b174dfc627e5e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878925, "uuid": "a6b0f73f-16ce-4236-929e-26b948cdfc9e", "comment": "Malware payload (Amadey)", "value": "9fe7120da34e29ad97dbd104d413fbbb7bdbf42743782790e2652999f053f157", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878925, "uuid": "be005606-22a8-4e97-84cf-49f12e922a6e", "comment": "Malware payload (Amadey)", "value": "db521050ef5de03fd9fe9ab8a55241d26888ac98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878925, "uuid": "c74df312-7f22-4454-bf0d-2a3876d5e61d", "comment": "Malware payload (Amadey)", "value": "9d7e9d199d3ad3fae1869a762e3c9f78c43a46c8b6d9a77d8d0d40b1f4941ad943b937c14457f948eb3b45ccb9722be4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878925, "uuid": "37b31ae4-cf13-4731-9e18-f864e4267bd5", "value": "T121C40217EAEC8022E8B417B409F706D30A36BE61673847DA734F695A1CB3261B53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878925, "uuid": "3369c4e5-7342-46cb-bfaa-73e3be36c3b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878925, "uuid": "180b2269-6f8e-4b4f-b163-498af22a6898", "value": "12288:EMrty90itstTxRzYqYpEjW2b6xTHl4tWW3Zja7eK3DAr149mhb5hjv:JyVtszRzl+EjWXl2YWyeK3cZAmxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675878925, "uuid": "8e75d693-a290-43a9-9793-c9968d968281", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675878925, "uuid": "2c800f44-911b-46bd-9de6-28d121005a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878925, "uuid": "d80eaf30-71c5-4eca-a6ea-c02002807184", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbdbede-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675885246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885246, "uuid": "7ed4a138-8a16-44c9-802a-9459bbf69d06", "comment": "Malware payload (Smoke Loader)", "value": "354eca8b975591f9520a4a9b1cb858b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885246, "uuid": "08203c5c-93c0-4abe-a771-bae6ccff0823", "comment": "Malware payload (Smoke Loader)", "value": "a018d20dcabdca669d01a163c095b08d24dfd05f0c092776f8e938ec32141fbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885246, "uuid": "0eb32a55-7500-4a69-94e6-90760e6dac38", "comment": "Malware payload (Smoke Loader)", "value": "5865df57e2a4210e8088288f40f4ed855bad325a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885246, "uuid": "0d249966-0dff-4616-8ad4-826b2cc61911", "comment": "Malware payload (Smoke Loader)", "value": "c93fbf064d525beb6ddeaa8379d9eb50c330c5383409b718f00ba5178ab57dceaef943dbca62e90172b23781b54d2874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885246, "uuid": "8ac9299e-951e-4cd1-9f55-adf34dc666a2", "value": "T17564498397E1FC40E9658B73DE1EDAF8761DBA808F2E77769218AE1F14710B2C163611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885246, "uuid": "82982558-51df-4de1-a382-502d535704cc", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885246, "uuid": "3bb3c588-c393-4536-891b-e655543d7731", "value": "3072:6PsCVKxKRNq8LHIbDT4o6V1hxB6CUWSp8RLStKRxhUw3:6UCMcq8kjji1V6X2gtKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885246, "uuid": "1bc15382-d6ab-41c1-9469-5112b93f4026", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885246, "uuid": "66d9189f-f050-4bf4-b111-1047a715d920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885246, "uuid": "f95e6e33-495c-4a40-a943-0dd904701561", "value": "354eca8b975591f9520a4a9b1cb858b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cf616f-a7fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893726, "uuid": "55983cee-21d7-41b1-80c3-9dc3f5e92e69", "comment": "Malware payload", "value": "07e73de70f3e77a3c2a6a90b003a56a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893726, "uuid": "137a91a5-6006-42ea-964d-d7735b18095a", "comment": "Malware payload", "value": "a0253597a85974127ced18973e7df4949826b54149b63e0bcccf7a11c7083b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893726, "uuid": "a80d5b5e-b18c-42b8-ac2c-f3d48d4ae4ff", "comment": "Malware payload", "value": "40d7c7ff20e9b57fc90a73bea5c1751a9b7c7c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893726, "uuid": "ad89d86f-9409-4d4b-bf66-29bcb91fb166", "comment": "Malware payload", "value": "9a24d2457731e1ccec1bb46d181a00deff079a82b8ccc1b179284f2b8f8e829ed2e4e92cd598cd6b646910653d3c49f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893726, "uuid": "31c8495a-21bb-4b7b-85ea-b24198092216", "value": "T18A945C03D2E17C90F9658B7A9E1FFBE8765DF5608E4AB7653218DA2B14F01B2C1A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893726, "uuid": "673001f2-ba1b-4fb9-aeb4-037d0b502d89", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893726, "uuid": "c34ba8fe-8966-4216-9fdc-a2aaeec41c13", "value": "6144:b/sCy2tBhPOqsxQ91KCO0Z9MipKCLhLiqmv:bkB2tBtOCPKd0Ztg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893726, "uuid": "3eee368d-7ba8-4b74-9f18-481efc62ce32", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893726, "uuid": "312d1daa-716d-42ec-b08f-58caec30065a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893726, "uuid": "a6167943-e01e-4b47-a22f-3e57bbb2d6bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d65008-a76d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675832303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832303, "uuid": "262d8da2-2a6e-4549-ac50-77a3e1db7dfa", "comment": "Malware payload (Amadey)", "value": "5f594ea5b326e9f3a0be779b54f094b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832303, "uuid": "e7b1d80f-f0b8-4029-94ac-9fe593a296d5", "comment": "Malware payload (Amadey)", "value": "a06b886134ccb2dc819c57ab2d3b668b31ee6b60f66663742c947b0ab9dbe250", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832303, "uuid": "24ece5f3-1ba0-4d5f-9a4d-d874f1fead39", "comment": "Malware payload (Amadey)", "value": "e299f2402ea185161971adc07d7fdf7d5a7c5df3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675832303, "uuid": "f0a75b40-f0fc-4a9a-9d5a-4f1271cd4708", "comment": "Malware payload (Amadey)", "value": "461e82a345393cf4ef9e9a6662db80405fefda612b075f419f9cd85e236a60324c3f41bc2353517a65c14b334e1858b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832303, "uuid": "58916ede-3757-4476-9dc1-eb42a0b76a4e", "value": "T11EB40217E7EC8076E8B5273419F642D30B35BDB16B388296624E6C5B0C736B4E63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832303, "uuid": "b99e0a02-5dba-4c01-b01d-13af7ade2fe8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832303, "uuid": "69cc3d29-cc87-47ee-9c21-4be8c168b6e6", "value": "12288:xMrQy90Ds7Jov3oTH1iyg9r14frk1aQtb/0Qc2Y:ByjloPoTH1iyIUrk11t70Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675832303, "uuid": "27877801-304b-451d-bf5e-77911c3329ec", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675832303, "uuid": "f34aa50b-9af8-4073-9fa4-46ba686807f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675832303, "uuid": "10bc5b3c-ca66-40a5-a8dc-d8038168a96d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134233a6-a79c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675852429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852429, "uuid": "aea9bc0b-1bcb-4cb1-bb4e-fe9d6e39fe6b", "comment": "Malware payload (RemcosRAT)", "value": "146e7d7ebe5bf3bff10c396fa574d794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852429, "uuid": "b355cd58-9d66-4107-a3c1-5a279ba497a5", "comment": "Malware payload (RemcosRAT)", "value": "a08099b97c3a9a73bdad62dee7223f3d2388f26a95f72f4c6d4a40d7bb9af774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852429, "uuid": "65d50c86-de3c-4f9d-91ae-0b48c1f18e59", "comment": "Malware payload (RemcosRAT)", "value": "adfba40dc7aa00c21a1479d8c925e78a2cf77c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852429, "uuid": "530d1b06-6ef1-46d8-ad23-9c8708582eba", "comment": "Malware payload (RemcosRAT)", "value": "b77a06d61694b4fab22e2e51a97393269c6a446a970aed3f7b93bc9c3eb3167b8e3ede5e1dae2089518333ed9f4e11d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852429, "uuid": "651c28c3-2a59-46e1-be1c-23dde5e7c719", "value": "T15D95E0720256FDD6FA6B1D94D0043E40AD5A1C93D668DA94F9CC32AFA1F5238FD98E30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852429, "uuid": "265e78cc-b5d5-475f-82cc-22643306916e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852429, "uuid": "22984a26-5112-405b-8504-694d774cdf0d", "value": "24576:61jfIgQsp0vbamlQ78E6jszlCwzxw1DyIgOPcXllhgoOvE54Qpbc+/c8x+OkmSzS:u6KsoplNKJP+nIbfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852429, "uuid": "4dd9268d-512a-4799-b055-a3d17fc56d9d", "value": 1936896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852429, "uuid": "9f582575-3dba-4e03-b096-35ff21d65558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852429, "uuid": "33903f77-bd09-4ed7-8feb-8710e1f55660", "value": "a08099b97c3a9a73bdad62dee7223f3d2388f26a95f72f4c6d4a40d7bb9af774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad49c8-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675883149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883149, "uuid": "b7ee3d96-355c-4980-b2e8-3c518f945915", "comment": "Malware payload (SystemBC)", "value": "2579be109c1035cb96942951710020a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883149, "uuid": "3162b3e3-4c5f-479c-96dd-1c6ebc57dcb9", "comment": "Malware payload (SystemBC)", "value": "a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883149, "uuid": "a05f4cbd-931f-4ff3-b5c3-83e36fbf67d1", "comment": "Malware payload (SystemBC)", "value": "6987472967c8ce5e3d5fd6730a9da2964afacd10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883149, "uuid": "9c80f234-d6e3-4fb2-87c7-af29fe45ec10", "comment": "Malware payload (SystemBC)", "value": "3a5ae9d31ac64174bf83630dae00b6aab2f162d8624cb347834ef4016074881faea723943913db5f3042d61721b6158a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883149, "uuid": "0fc16e7c-6265-49c0-9cd0-eb3cf0a99b6f", "value": "T16EE3E0E6FA4BC312C70649727F4695E2A9DEBF188F3F4617354EBD2C7A336846580205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883149, "uuid": "9b814a3d-eb3a-47c4-808e-7e5f141bca94", "value": "99b5c3b0fd6634c3aac7bd5550f0cca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883149, "uuid": "ee4233c3-0e67-4812-b0cd-fb102b8bc0d3", "value": "3072:9NuSXw/c4JHdNX8PAzCABaxg0r27f8EjQspDNJJAksa:9oSXw/hfNXmAzbYg02Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883149, "uuid": "2f7d3abf-74d4-4243-a48b-a161e348e859", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883149, "uuid": "28b760dc-f4b1-4d57-8aaf-b87c2f64ce7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883149, "uuid": "7c5830d4-1f6e-4727-849c-b3b07d4e8edb", "value": "2579be109c1035cb96942951710020a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fbe10f-a79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1675851654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851654, "uuid": "bd885d1a-5486-45eb-b864-6d35f9adae9f", "comment": "Malware payload (EternityStealer)", "value": "5edb806bdb9c9722ef3e462c2de79387", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851654, "uuid": "7e357ad4-af02-40e4-9eb9-ce131b282c77", "comment": "Malware payload (EternityStealer)", "value": "a0bc1875cfc85a930f69f40d2c1b66b9de3d79382b2e2c47f5ad60759944335b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851654, "uuid": "00a0a797-7c90-425c-8eba-bd97d1fb272a", "comment": "Malware payload (EternityStealer)", "value": "7f578ee428b4ea2a735c078db6ee0c567afe7d20", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851654, "uuid": "6cd6c855-7471-4f76-b71e-ed65fe3cfa15", "comment": "Malware payload (EternityStealer)", "value": "bac25cb4caf8faa810546bb2aa820ab5d19d22dd6990daa8c86a41e9a763c40935bd2bf7e116b5f74ea4196a196decc9", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851654, "uuid": "167471f2-4376-4703-80ac-87928f1ff0b3", "value": "T17874CA283BF4CA29E1E4663D49379332C3A403A30F17B30EAB17B5A63A5516DCD476D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851654, "uuid": "a5f4d9ad-f8f4-4036-bcda-69a1cf0eb969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851654, "uuid": "5f747834-6053-4d58-82c5-f95f16fbc662", "value": "6144:OyO9/ci8TuAlc76woqxf8wXo/Er2Ebhvp6bRleZD:OlUiYc76wjjnrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675851654, "uuid": "958fe49a-f9a8-4235-82bb-13d8a1c55f1a", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675851654, "uuid": "19e14191-8328-457b-86e4-587a5d027b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851654, "uuid": "27ccd4c1-94da-4891-8f2c-ef2fc1390471", "value": "eternity.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02f2cc3-a806-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675898327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898327, "uuid": "b852ac59-0ad4-4ebe-ba3b-a8b6223254f4", "comment": "Malware payload", "value": "563c608722283c035a36ec8d470c8998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898327, "uuid": "8bb98ea6-a1be-47c4-80dc-025554b62f6f", "comment": "Malware payload", "value": "a1e12fefe0c2948acabf0bc1787a7a490ab2dbe004b0f0190a55f87180e0d1ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898327, "uuid": "b7f20b37-6e3f-4a3e-a64c-372324bc7cc8", "comment": "Malware payload", "value": "bb11e511c94279f318a366c7e11b227443d568aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898327, "uuid": "ed57b7a4-b41d-461f-af0e-9c54297a7e9b", "comment": "Malware payload", "value": "3b6597195c09203aa9d1f455bbec4d3919c09f30893e031efddf6fe4f4d3a7a69f7d7a67f3a02416485d066bbf19ddcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898327, "uuid": "aee9e5c4-73d0-45a8-bc51-85ad36b7f33e", "value": "T19FC41217E7EC4532D8F527B019F202C30A79BDA1A7384317278EE95E18726A0B67177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898327, "uuid": "c79197de-f15b-45e3-bcbb-9b4f24c9efe0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898327, "uuid": "a2c56f4b-6929-4de4-92f5-5863443d72c5", "value": "12288:7Mryy90i2QUWXvSLM+tBhkK4QC6cRxe1oO8zOJqlu2DF:hy+uvSLM+tPvCDxeuOOljDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675898327, "uuid": "f896a175-abff-4423-a3bd-a804fe1922e1", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675898327, "uuid": "b11d9585-cb89-411d-b9bc-71d4d1530c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898327, "uuid": "f33183e7-713d-4320-8979-34189b6b16e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2919cc-a754-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675821819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821819, "uuid": "3696d039-1eb1-4689-a52c-58509feeab98", "comment": "Malware payload (Amadey)", "value": "48371c2028e6d64e8ab2da0ef29f2e40", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821819, "uuid": "85e8039c-ccf4-42a2-ae61-6834e3dd22a1", "comment": "Malware payload (Amadey)", "value": "a1eac1e3b188151595d6b96c050c4ea43c0f20901b53ff95c72d74606606860a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821819, "uuid": "3f8d823f-d06c-4383-9d8d-e4c16f89c0f9", "comment": "Malware payload (Amadey)", "value": "fdf3b650d337f4cba5e226f7c534181a315f03de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675821819, "uuid": "39f5afc2-982e-4744-b83f-bc274346f8f6", "comment": "Malware payload (Amadey)", "value": "01c045527cbf31ed4014da82c3f58bfa35abbc9ae48a17aff2e809f02cf4abc65ee01252f4520d4fa7ab206d39d82d6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821819, "uuid": "629e2b52-fa9b-42e9-b9d1-073748020f98", "value": "T1A0B4020BF6F88472D8A567700AF603D706367D605F38835B625E6C6A0C726F4A63277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821819, "uuid": "b8cff436-738a-44e6-a592-ab71be0c645a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821819, "uuid": "1a2a1473-9a6e-497e-96fc-094b758eba2e", "value": "6144:KLy+bnr+Gp0yN90QEqDQOwA0/oHUgQeZR1xwEKqlJW6V5EcduDB/72d+q7CCrZiR:1MrWy90+a/omeZRwNaTacPC+qoZdRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675821819, "uuid": "250c3cca-1050-453d-9dad-85b1ae0bd81f", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675821819, "uuid": "566d3421-81a2-4185-9a5b-b8c8a7867ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675821819, "uuid": "715b3f8c-a25a-439b-9114-892a7786e31c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63902733-a747-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675816057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816057, "uuid": "9ee32a42-0bb7-4a7f-a604-30bc4c82db75", "comment": "Malware payload (NanoCore)", "value": "2c349b09e9328cfc98c0328099a73066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816057, "uuid": "17dc24c2-066b-460f-9b58-75654ad488b9", "comment": "Malware payload (NanoCore)", "value": "a200584df549577d7ac69c3dbafc1700f26e8bc14a14a59df155f0fa1030f4e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816057, "uuid": "0f9675ec-45a7-41bf-86bd-f3f7206312d6", "comment": "Malware payload (NanoCore)", "value": "fcb4294854c061e6ac496bcc123b26347163fc64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816057, "uuid": "83b8fcbe-4965-4147-ae9c-05d779ca2d54", "comment": "Malware payload (NanoCore)", "value": "9d5c64ec5b676a1dd0c5ea3278e5233cf92dc89bd4af522c4226fa44425046aa0649bc32b017104993a8ded6957c7450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816057, "uuid": "9ecaaba9-cb8e-4dae-8982-f07facc23d0b", "value": "T1A3F4E0637641B2A2C469C073A51B84D30BA1AC2A97D52FA7319CF73F94B6024D35F72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816057, "uuid": "d39df572-78fd-4a8f-9ea5-6aabecd0f83a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816057, "uuid": "17810744-80e0-4fec-8ca6-7083e2c9c34c", "value": "12288:cYCjROpcK2rLeDU+qcHwOsq5GRG+LrB38nq2YgNTCpCjFZg:cYCVOpJ2rLAj3VsXR9HBQNT7j/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816057, "uuid": "76171e10-75ea-4117-ac2e-28822e24d622", "value": 791037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816057, "uuid": "f6c97f4c-e2a6-47a8-9f9e-a8e848feb76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816057, "uuid": "dd9419db-60ef-4807-8b59-025bb7db144e", "value": "2c349b09e9328cfc98c0328099a73066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc0e1a4-a7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675863000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863000, "uuid": "9d5f40f0-a3ac-44a0-85c5-84fd7a38e48d", "comment": "Malware payload (Mekotio)", "value": "0690eccc2927dec39f6f1ec0f005fa3d", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863000, "uuid": "114edfea-5b69-4d31-ad3c-58d4c389af19", "comment": "Malware payload (Mekotio)", "value": "a22d1526c7c0301f611a2a830188f791dd37d697f4d9765113188583b91cfd36", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863000, "uuid": "604a5ef1-0604-4bfc-93c4-704e400795db", "comment": "Malware payload (Mekotio)", "value": "755de350cee32b0d48601e6036818a052d8ffa26", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863000, "uuid": "7c3ee768-6308-448e-bd1e-fce930327bdd", "comment": "Malware payload (Mekotio)", "value": "dec3a0f5f94b4f45ecf7dd273041c9beb8a0501ea2564e5f52b96ca847eef96a99a60d37e7cccb218634ba6bf7b99f1e", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863000, "uuid": "d26f6652-b67e-46c9-a61c-e1a8033d47b8", "value": "T15EE63322B09378B2CF255914DA213C877E13D3C68CED8F5D9CE46BFB5A848C850F5999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863000, "uuid": "07038ab6-65c4-4b83-8e18-17d3c9bd9cfc", "value": "393216:DKzTzQaGkqqXe0aHbluFT7MDwsxbIbYg1F:OHcbDz7UUwsucg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863000, "uuid": "b1def485-87e4-4912-988d-067abfa4d7db", "value": 14838290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863000, "uuid": "88f6ad34-e23c-4dd9-b86c-d700672bf30d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863000, "uuid": "6181ace1-53e7-4b0d-a000-56b031a0a57d", "value": "payload3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e10b8f-a7dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675880161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880161, "uuid": "76eb1762-a4e3-4d61-a978-31ee66b71e09", "comment": "Malware payload (Amadey)", "value": "e0a1f899c2cb1a72500436f5b8337e10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880161, "uuid": "19faef65-9067-4f40-9d0e-8711225f9cc1", "comment": "Malware payload (Amadey)", "value": "a251ecd0d64c00a88c41b8247952f68a31a7393775e6d962906de04cea2fc4f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880161, "uuid": "87fbac9f-4462-4121-8309-12a2b416bb75", "comment": "Malware payload (Amadey)", "value": "135b0fa36c2430aeedb175fc75dbc861032088da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880161, "uuid": "3840de13-747d-42d1-9a04-022b8f801111", "comment": "Malware payload (Amadey)", "value": "00c66c643bcfe1dfce38efe893d4bf89c6018a2297539d9c1677ff3dd558f5589e5f37d67cf376f4e4fb8bed3f6a6eb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880161, "uuid": "3014ad1d-bee1-437c-a1fe-801eac106a5b", "value": "T173C4025BB6E89132F8B057B05CF602C31A367D956B3847DB238F595E4CB22A076313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880161, "uuid": "a2046aaf-22e6-4014-874e-e4a681fa2a96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880161, "uuid": "34e62ead-055c-4d76-bcd9-52ac00c0f44e", "value": "12288:HMrpy90XrDCOHH5p1EfO+BTHl4tVWS1jaleKHA9ZdD0J:OyEDCOnJERV2XW1eKG0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880161, "uuid": "11348da2-75aa-42df-8d98-45c201e86af7", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880161, "uuid": "0b88541d-ef24-4c43-ae77-8b435dec0ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880161, "uuid": "13b74f82-861d-4b19-a838-48f76cbd8df1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6c6b32-a7e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675882645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882645, "uuid": "9f3a4508-e508-492e-b928-c074b425e180", "comment": "Malware payload (Amadey)", "value": "dd666f81ecfe6170e3dcdb2592eeba7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882645, "uuid": "bda4ba46-ad52-4daf-840c-2d73970e99fb", "comment": "Malware payload (Amadey)", "value": "a270c6af8b1f96f2e014cf0698edea7d8fab02d7effb981cd6ae1c4226415fc8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882645, "uuid": "ef3b286f-7ba5-4cfe-8dd4-d310ef0f95e1", "comment": "Malware payload (Amadey)", "value": "ade04c02fd457c467119f1d6b71677f73c899616", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882645, "uuid": "0b59bca7-df17-4d10-ad70-33c5ccfb6bc7", "comment": "Malware payload (Amadey)", "value": "783dcd6a9616e7137a26b6e93db8b37556e95d6fe8d6c8ab9c4f6f7a27d5bc760b952d007a0cc950181f1898fd794688", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882645, "uuid": "390e3882-b67c-4e39-add1-395e459056a8", "value": "T18DC40207B7F88136F8B52B7018F706D30972BD604B3887A7239F6D5915B25A076363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882645, "uuid": "f4025e04-d45d-4ed7-bc15-25349539b5cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882645, "uuid": "d1a1a3c2-94d9-42af-ba18-9fca5567d91c", "value": "12288:kMr3y90yvUVJhvua52I0HDwdYrjoXoqlbP+tKtDxiJF:LyjcVPvZ5b0HtkoqxP7iJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882645, "uuid": "60497ba9-7e58-41a7-ae8c-047b0ef3f070", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882645, "uuid": "6d9f165c-03a2-4ba1-9a6f-0540a9bf027b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882645, "uuid": "a72a0339-a5e1-40de-a48a-35ef72845015", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606b6a9c-a79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675851700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851700, "uuid": "9c9eee69-c2c8-4629-bc6c-ebbd3e939f57", "comment": "Malware payload (Amadey)", "value": "e18d70ade4c5363c3b9d96123776a9f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851700, "uuid": "a08efb94-44bb-4881-95bc-ee2eac7cb403", "comment": "Malware payload (Amadey)", "value": "a2f3eae8b595ce5ff3b308d42104b2a3d7de7eba1af233e18851c685eff2a4ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851700, "uuid": "faf9deae-a66b-4db2-b480-7820ba05369b", "comment": "Malware payload (Amadey)", "value": "f6442a5caa0180a6a7d584f0d800528ef4f8ecb9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851700, "uuid": "9c501549-90a5-448d-a18c-bfc369a75a4a", "comment": "Malware payload (Amadey)", "value": "27c41bf59a2c53b665b52c6a9374823453bab3d43d2b9dd5bca3d21dac9091334d3f4c17f9d49500b323c63c3721340c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851700, "uuid": "9133fa4f-e5d2-441f-9f0b-d950159469f2", "value": "T126C4021BF6EC9136E9B107B01AF703C31D3ABF555A38839B220E6D590CB2565E636327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851700, "uuid": "759e2929-6d33-4b44-bbb9-5ad45cdb808c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851700, "uuid": "97472de7-8886-444e-a221-eac59b25bb7c", "value": "12288:XMrhy90luGa1oQmdVB0Su9zxMFeJXGs5WZ8d66k:GyifBSz2eX6mrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675851700, "uuid": "6fd1fb33-b37c-44b8-98e5-05482342f4f3", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675851700, "uuid": "1a2b6277-eb2b-4fbc-9d0b-8befd13e01a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851700, "uuid": "34c1c79f-2a82-45c3-823e-a5961807ebc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82694dc-a752-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675820977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820977, "uuid": "b7705784-a8bd-47c8-8306-4e163c2c04f2", "comment": "Malware payload (Amadey)", "value": "e9991dd0a6cf1ae7feaea2b0f6d89360", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820977, "uuid": "77492efb-8484-4a3b-8744-c20b2b67312c", "comment": "Malware payload (Amadey)", "value": "a3b9a3738c36dd4940172d80fd72e16ad0f4e10517adfed64cfca286e1bfbb3a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820977, "uuid": "ebf869e2-34bf-4f55-b24b-fb03caf82898", "comment": "Malware payload (Amadey)", "value": "2e24977d14289d0a1edae3bab709a1ff7d7e8b12", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675820977, "uuid": "4691fca2-94b6-4334-91f3-73a823fae410", "comment": "Malware payload (Amadey)", "value": "80475fb31d76a0494441cc261ce637b796b3e472318cc1a8617e51c9ad27e168cf64e8fad5f2b2569e8878dd07fbbe50", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820977, "uuid": "0f477f28-5353-4a19-b194-1be25b953cdd", "value": "T1B5B40187ABFC4173E8B6137009F702D70636BE70AA74835B234B5D6A1C726B4A635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820977, "uuid": "ed30b649-77fb-4823-91a2-47f332af009e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820977, "uuid": "e1159f4a-642c-482e-bc45-b02a4dba8c23", "value": "12288:zMr6y90BoQzPLLsqv2h+DISaAPCPEdI5Q9:tyfY3Ih+D9JKbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675820977, "uuid": "35582522-39be-4767-931e-3ad366046ea9", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675820977, "uuid": "741ebca5-a56f-469b-b88b-bd9c516d785c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675820977, "uuid": "e48c79a5-62cc-4e7a-b8b0-1606c4b28f6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e36914-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675881420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881420, "uuid": "e0541cbb-b107-4aa5-9577-ea9b628dac51", "comment": "Malware payload (Loki)", "value": "4d0c7f86b0e57066396f5a7b96eb1a49", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881420, "uuid": "4e17497d-abdc-4706-a00c-71d6701a6dd2", "comment": "Malware payload (Loki)", "value": "a3d6bb9bcec84d97233aefc0f3fa839119d1a9af04581c7874e07b1292dcd7a4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881420, "uuid": "3a77e416-1ed0-439f-a68b-3870b92bb140", "comment": "Malware payload (Loki)", "value": "c8e04472398c857cc8eb9b20295a41eb151ea8c4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881420, "uuid": "a9842a29-f892-4afd-b1fa-e47ed03b6eb8", "comment": "Malware payload (Loki)", "value": "642ae11573880009a7c1a2f5724ee0596bdfe97e37eede426b4262a391f0937f98c6c92f2620119d076ede93f013f3eb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881420, "uuid": "dc405fe7-523c-47b1-afd6-9e52b5488cd0", "value": "T156C4CF0FA271EE1BD012C7BDDEAF86511347BE389653A55F6100BB6E1F3225099FE218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881420, "uuid": "a33c40bd-af47-4059-9fad-870938889dea", "value": "6144:yaFJkKXiDU7wo6cyBpezcOPqGjZ+RwPONXoRjDhIcp0fDlavx+W26nAKC0LHAV0J:yaFiKXKPcyBpezBZDDDAGQm78JU68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881420, "uuid": "c26721fe-da95-4b7f-a6c0-3c7314036337", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881420, "uuid": "797aa94f-ba78-43b0-b063-9685c1a47737", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881420, "uuid": "aad21bc9-a4ed-4b2c-a793-d27c14b283fe", "value": "P.O #306078910.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46784023-a7f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890740, "uuid": "247d36c8-fba4-4afe-9e3b-51b65a19b64e", "comment": "Malware payload", "value": "b7a11d26fe0e456109ef903821518611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890740, "uuid": "a3ec64ef-7541-4dca-a51f-a156d2db9e46", "comment": "Malware payload", "value": "a400e54ee9567ad9a20c4c8674cad59b5658dff5b46bc29fda15c3d0c4f6e2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890740, "uuid": "80ac73ab-3aa2-4c60-80ac-86200f112485", "comment": "Malware payload", "value": "f76dd8d208bbab6b3c8b22577b1421bf5c9342f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890740, "uuid": "8957f2d7-cde8-4889-a213-b35d0ebd0411", "comment": "Malware payload", "value": "25ade5ccecf93b74e62dc21882e409d1e41a806c5b7c935edf0f2367b010cf99fdec26d5a69aa9f278a712435fcc14a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890740, "uuid": "3aec4c3d-51eb-42bc-92cb-f6aff7be9491", "value": "T178A241613AEE416EF2B79FB13FE024C6DDAAF2763529A85F2441030B4E51A54CE4263D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890740, "uuid": "ab0d68d8-59e4-4e98-be90-d84545225fd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890740, "uuid": "3a641640-2815-4fc8-b790-a62e376db13f", "value": "384:VShwOTmAba3NHHKCVv+bdmpZqiqhzK36JAtkYCZtCC2cl5ZkI2i/fBo:VLOaAba35ompSFIDBMSU5ZN2ixo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890740, "uuid": "4120be70-29fa-45d8-9a15-4bc53344b15d", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890740, "uuid": "b4cd1137-01f9-4381-9951-fda02e853b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890740, "uuid": "f6cf6249-00ee-420b-9522-d625893643b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183b0580-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675867900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "7e663e86-c1da-48f4-b7f6-eb2163609c80", "comment": "Malware payload (Amadey)", "value": "acb7186c421bf69e5bea05489020bd80", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "931255d8-fea6-49ef-8093-cad4228aaf7a", "comment": "Malware payload (Amadey)", "value": "a41109209031442397e78b8a5b9fd72b4fc9a8a3112e4248a3037dd23da08e90", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "76c54737-ecad-41e3-a02f-e02cf631567b", "comment": "Malware payload (Amadey)", "value": "3b967e911a1c8a22440843d0e09c9b4882029c06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675867900, "uuid": "55ae1094-40d8-4085-976d-a2cc832ae9ab", "comment": "Malware payload (Amadey)", "value": "4aa0b4157be7a546be3281115b33ed0e435fdfae44721c7cf9024d3a059c79084678d29715512a18bd5baa0674036e22", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "e5ef209c-71dd-40e4-a76c-0b196cd09473", "value": "T169C4120BA3E8C436D9A4677019F703C31536BD615A3892AE739EAC5B1CF2774A13136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "c35f7e8e-5c34-49c2-a6e9-d1c7a3c17fa8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "d0429c7c-11cd-4509-af7b-58f73885d94a", "value": "12288:6Mrwy907uAkg7AOVbagUHC0qo36ZZmCRBFzyd:Sy6k0AORagEqo36yu+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675867900, "uuid": "1800532e-2138-45e3-8cff-8a73e24a3a5a", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675867900, "uuid": "62fbf103-2272-4eae-aa95-aa732cc21744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675867900, "uuid": "cc7b3032-4458-4302-b76e-043a633c7faa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7dd0c1-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675881406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881406, "uuid": "c351307f-d8fa-4f97-acdf-3bf25d174226", "comment": "Malware payload (Loki)", "value": "745a4b7c4e9cd37a507b5d32ff8cd11a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881406, "uuid": "b4ee0ee8-5d0d-442d-a342-92be824560dc", "comment": "Malware payload (Loki)", "value": "a44e96c70171ffeff132b26969d39022be8f8af214f6fef9bcee644417315220", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881406, "uuid": "6cff3859-f8e7-480a-b282-c992d1ed5d4d", "comment": "Malware payload (Loki)", "value": "f07d044b4dbf365bc57a77d12bc826dc31e748c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881406, "uuid": "a0f14a64-a8aa-43bc-a42b-f6a8ff7489f4", "comment": "Malware payload (Loki)", "value": "7a52ad31c540a4cef66b8f2b1cde5e34af7f64cbb495325ea2be072e562182ff47766c18aebde821763dc6d0a10a7767", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881406, "uuid": "f5c846b3-0f0f-42db-9e17-6ca93a1d5d80", "value": "T15D753A0388049B83D51D83F8BE535EE81F5A6F19E4916EEB345E3F8B3B31662198E11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881406, "uuid": "9003ff49-264e-4bd4-bc83-b2b6bfd86856", "value": "24576:ALKsZyIZy5ZyWZy0ZyVZyMZyTZyodc/fEx5HfMazCawDEUdis:ALKepknF81eddkfKHUaTUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881406, "uuid": "1440bee9-e416-4275-9b10-b21e388fdbad", "value": 1653248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881406, "uuid": "0ec1453b-b766-4dad-ab07-c1fac2ed0f06", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881406, "uuid": "19ea0f2b-3a0f-49da-a937-41be1f9c7f8a", "value": "RFQ No 02082023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6219db09-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885633, "uuid": "05377081-4b93-4810-b746-c68f773423b2", "comment": "Malware payload", "value": "c90319d8f04e97659710269e07476267", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885633, "uuid": "49debed2-4f0f-457d-a9c6-f5c5cc1de53a", "comment": "Malware payload", "value": "a45c8379bbe107a65c06aaec728783440e31a1cfbdea19e0d7de90582d3fe242", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885633, "uuid": "ab0f223c-370f-472e-b2b4-1d7b8cc47436", "comment": "Malware payload", "value": "aa5caa67088e29315a9f46f8ccef6a3fce24cfad", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885633, "uuid": "bbb4d15b-dd48-4020-adfc-4be2b3f9bc23", "comment": "Malware payload", "value": "e2bda8961e7b329f4d49ad8289795da986bcb1487de48a886c57d4d8121c9177cf423b8a6e867ded9b94d3c5160ef8a8", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885633, "uuid": "a5b70dcc-56dc-45c0-8ca8-3049af03ac4b", "value": "T1D021EADD6AE05C9442C060003AE96F6F667F2AAEFC206D910D6DE80DF4C5550641703A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885633, "uuid": "7bdfd8de-5d13-4fbd-a437-75f7b6af511d", "value": "24:0j5fk4YwXBERU6kLAJTr5g+9y9CiwaLiUuEMfwtcWnP1ISVJw94lGStJtlZiYz:0PwU6flabuEztcW+cm9kvt3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885633, "uuid": "4d9ca1dd-137c-4b80-9240-b8c988901f61", "value": 1236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885633, "uuid": "76de2415-6901-48b2-9bc5-014c1337639f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885633, "uuid": "273f201b-ab5c-480c-8c86-6f16906ff28a", "value": "427305aa-b132-4a4a-bcc6-ad9cf3b81f20.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6501abb0-a7d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675877477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877477, "uuid": "8ce65416-0c1d-4769-a9e3-a31130fdbc82", "comment": "Malware payload (GCleaner)", "value": "4fd4ad3543f1e34db1c39f55495aa810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877477, "uuid": "b847609c-d947-45e1-a037-808f9bcfa879", "comment": "Malware payload (GCleaner)", "value": "a4749dc094d9e3a245dbcc587ab27433de63761343a4eea4d9994950fb352bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877477, "uuid": "4178c85a-3379-4273-8365-9fb1b0a4d6e5", "comment": "Malware payload (GCleaner)", "value": "51ab746eb666acf62e3f6c405a5f2a349b97f72f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877477, "uuid": "9566cdc8-74d9-4e8a-9626-c699b6287afd", "comment": "Malware payload (GCleaner)", "value": "04e7e46409c4e46930f3af46fd4eafb3bc3f7c96435a08ce87af0e0df25654deb8c0748560c8915465577d2c87824278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877477, "uuid": "068b7055-19a3-4441-a595-defddf8536d9", "value": "T189C5127C7105C96DC1C0FEB88D26D8E35CDA6EE3E9D4A46271D8BF3F92B92895609103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877477, "uuid": "51e74d6d-f216-4b3e-ae9b-f68b2698a5a6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877477, "uuid": "ba34bc67-6c25-47a9-8d00-ef875d5af961", "value": "49152:rdH4ZjwJC2OFZ3foFnaJCKpAdZ56Or+fbbq/b5ZwRpPSc4aG4hFcVLCgv2MR:JHojwP43fcnaVudf6O+S/dyRpPSircJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675877477, "uuid": "2f881227-b688-4856-b71a-10abef5a99f4", "value": 2679813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675877477, "uuid": "6fa83295-f4f7-464e-8504-5fbdfbbf8b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877477, "uuid": "286a5f06-c52d-4f3a-8450-3a749ec9f00f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed1a1e4-a7bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675865817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865817, "uuid": "4d366162-a952-4e01-961d-c9b18566a87b", "comment": "Malware payload (Amadey)", "value": "c8eddafdce585dc68cb3b05aa7ec8055", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865817, "uuid": "d3ca886f-be75-46e6-8afa-aa1959901d8d", "comment": "Malware payload (Amadey)", "value": "a49e553905b1049d5a49dd4071d3bca37c8893296ab818b8490a214a6d2d8e3f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865817, "uuid": "8f4e75f4-11c1-49f1-a3b7-1b09ffed65cf", "comment": "Malware payload (Amadey)", "value": "f9df7de8b70316d2f3726fc2ca064f9e8bd7d63f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865817, "uuid": "bdca5c39-547b-4f9f-9fe7-623858ed11e2", "comment": "Malware payload (Amadey)", "value": "2867259c321bf48daa76006bf22c80a4410dba46bf124ab3c2905712b1d76b0a940a7108ceccbf78464a425b803bb8a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865817, "uuid": "ebaa10b6-e8c3-4314-80b4-37980b932ba0", "value": "T196C4120BE3E94432EDA4677019F603C316357DA19E35C29BA78EAC0E58B3674B53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865817, "uuid": "6360eb60-3975-48b1-a7a4-bc409a30bdd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865817, "uuid": "f8fa41b9-e1fe-4dd8-83c0-4f9bc60e5510", "value": "6144:Kry+bnr+Vp0yN90QE++aN+PeyADmnkBHNrz2zYv2KBU44FXVz1tBc8qMv07SjJEz:RMrNy90U+PjAiUX2kvHW7qoWcFVvhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865817, "uuid": "5f4acf7a-767a-4c9a-96ef-3540aac347fb", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865817, "uuid": "6cf51cab-ab48-4513-bbb3-fa583b7fc8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865817, "uuid": "72d7703e-4f9e-4f97-abd4-e65946f8924d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f73a89-a7d1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675875350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875350, "uuid": "5ac2627c-2539-454d-a17c-5f68f01eef34", "comment": "Malware payload", "value": "ae1f61e32aed64be19db5bc852bf9e0c", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875350, "uuid": "623ad5ef-50ac-4bfd-9641-418ec8953925", "comment": "Malware payload", "value": "a4ba02fe0a70c005c1dd5e10a58e9b9799ecc85cb60b283e4ece7ef4dd199345", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875350, "uuid": "48b62515-3a65-47de-9265-7602f3bd9a9d", "comment": "Malware payload", "value": "f2f086c02b8468dc4b935c28c22d0b3212c39982", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675875350, "uuid": "8028a178-3629-430c-bea4-10be7988debf", "comment": "Malware payload", "value": "5b2851a348f830d07228150f1c42e53e5434da9165e546edc6034ca52d3a63d82f4590ad5595f19aac4acc449e3ef468", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875350, "uuid": "94e41823-c9cf-4c55-a87b-3a64969aaafa", "value": "T15011F0F69B5E5013C9B1CB411D5B525ECF6040A298C00A04F8FE4E70DE3A223A35FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875350, "uuid": "dcb8f814-d663-4188-a9f9-7a4fe90ea405", "value": "24:DOVtyCiq5dsFTxnswvpdPNuR71q2z8JAh/:DOVtyCiCsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675875350, "uuid": "4d687b27-b2e5-476b-b1b7-2a280a26fcc7", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675875350, "uuid": "c413fc28-2abf-4bc7-b7ad-9d5b95ab10ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675875350, "uuid": "e088e06b-5b9e-4716-bef6-c0ac7d6dc908", "value": "N6YQHyHM.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cbc252-a79b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675852351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852351, "uuid": "acef6de2-376b-4868-9420-871780d80fca", "comment": "Malware payload (njrat)", "value": "5b18035c3b32b8f315c2ad554cfef243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852351, "uuid": "73ff5411-a37c-4368-a8c1-9c609d149ec1", "comment": "Malware payload (njrat)", "value": "a5207f85519c9cafdaac78e7449401fe9c54491a4ff6b852e50472ad89845662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852351, "uuid": "001c51da-b652-4ace-9a99-ddc78ce1abba", "comment": "Malware payload (njrat)", "value": "ca4b41233bf65a754715111dac497747bc95492d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675852351, "uuid": "98eb9b65-51cd-4a7d-a36f-4cf0d3d39780", "comment": "Malware payload (njrat)", "value": "08be37dc602f1b5b3b2d52074d99c557e5b1ed74d3f62d3690516517bb4e5347c656bcbbda02489d4c29299d903c8c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852351, "uuid": "328984d4-e680-45bd-9126-9feacee1f6f4", "value": "T17E93D74977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852351, "uuid": "5127e687-2351-4d0b-a15e-6c2d5211b886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852351, "uuid": "48740a0c-d33a-420c-9bbc-3b19870a6b46", "value": "1536:jUwC+xhUa9urgOBPmNvM4jEwzGi1dDTDogS:jUmUa9urgOkdGi1dLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675852351, "uuid": "278522fd-d958-4f69-877c-7b0c470c9157", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675852351, "uuid": "2c9eb2b7-f14c-4e23-b920-3caf802e4d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675852351, "uuid": "e904ee94-2f46-41db-87a7-e7e84e78a5be", "value": "a5207f85519c9cafdaac78e7449401fe9c54491a4ff6b852e50472ad89845662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f188836-a7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675859509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859509, "uuid": "be861b3f-5394-4ca3-a3c2-ddb4854472b6", "comment": "Malware payload (GCleaner)", "value": "98906bc33a224091dc0b7641bd3b15a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859509, "uuid": "10b8abfa-a01d-4ce6-bd43-cfd2c3162dbf", "comment": "Malware payload (GCleaner)", "value": "a540b05f47b395fb47d50f9c3999665640b19a2b0bbb4a2c5ff7c2bb0d5a7f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859509, "uuid": "6d7a4a85-f69c-451c-8bc7-dc3cff1b5ed7", "comment": "Malware payload (GCleaner)", "value": "47133ca2352bd9723fca640949adfb0a6ba0b606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859509, "uuid": "df759e8c-e301-44ac-a592-78ebc2a8a5d7", "comment": "Malware payload (GCleaner)", "value": "bbc9aa9ffee4eabc41117da1d5299615e6127bab574c59d504deab4cf57389e5232cd53368da0a1653ac852669e4be6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859509, "uuid": "7d31e7ed-db94-4b30-90ed-774be0a433a3", "value": "T11EC5127D7105C56DD2C0BEB0893AE8E71CD76EE3E8A0646370D97F3F917A2858A0A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859509, "uuid": "8f8461e7-d310-4e83-9c7f-0076a386040e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859509, "uuid": "b571c112-480b-420f-a80a-61a87f95d4ed", "value": "49152:rdHuczwEX2vjkqcYj/eMZz88RbArK8e/UU+v0gX/3zphLCgv2MR:JHu+XWjXj/eGdRXb/UtMgX/Dv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859509, "uuid": "4a817ac4-bf34-4914-8c3d-dcfe5baa982a", "value": 2672177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859509, "uuid": "f4f79215-f5f0-41f8-8db7-8aa49118817d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859509, "uuid": "b4d1af6b-5b7e-4c9d-b780-462dbd143b54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d24947-a7e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675882844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882844, "uuid": "a050877c-b9e8-4533-9fe8-92b3697b1e6a", "comment": "Malware payload (RecordBreaker)", "value": "856a88a6d52ecf908cd6e8eb794da2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882844, "uuid": "70804e0b-7c93-4d84-a595-39ce0270cb7e", "comment": "Malware payload (RecordBreaker)", "value": "a59f994227548df28cf3a3431708bd9f081fbea13087e552c8e7345c83733b86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882844, "uuid": "6ee56035-9e49-4a16-bc9d-22bb3a87e8e2", "comment": "Malware payload (RecordBreaker)", "value": "c5b8e15928a7c5f9ecf30108218966b497e55902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882844, "uuid": "67e528ca-d082-45f6-b150-eda8a0ecf70d", "comment": "Malware payload (RecordBreaker)", "value": "bde2a7c2bf4f9a577f02b91d1654a7a124aa44555d237b58757ca3109da60a6f66e588e4d723cfb5784b3214eef322d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882844, "uuid": "0d8597aa-cc49-4cb7-ae3a-3ce4452baa4a", "value": "T1CD641803D2E17C81F9668B7A9E1FFBEC765DB9608E4AB7653219EA1B10B0173C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882844, "uuid": "0e3b322c-202a-48ff-959e-d61af169cc49", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882844, "uuid": "f75e6f00-36e9-4623-882a-86f23cc75f28", "value": "3072:xPgedtUxzxR9zhrlFQ0z3cJk3516Dj7F1bfzWJhWsWQDiuLpiigvJ:x1a5NrlFVUkJ1677fzWDDLiqi/vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882844, "uuid": "8cf01a9f-b204-41a4-a7b3-13745cac2720", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882844, "uuid": "d91f617c-be18-4c69-af38-872c20fe9c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882844, "uuid": "ab14b928-0d51-49e5-ac7c-7014bdbf5cd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cce788-a771-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675834212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834212, "uuid": "78582bb3-1244-4560-9ea4-937c74bacde0", "comment": "Malware payload (GCleaner)", "value": "946b2fb4fbd6036de0432ec0c3aeb43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834212, "uuid": "744447f0-c30f-4fd2-a93c-5bd83c95e8e4", "comment": "Malware payload (GCleaner)", "value": "a6b57b94e5a97ac7076160af33e18212d0df35f8ac7a0a7b01cea2ce8c1f57b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834212, "uuid": "149cdef0-2bfa-46b0-8588-a1598dfa9b7d", "comment": "Malware payload (GCleaner)", "value": "ffb579c801cef24ee38cc97cef8490400c0ddbff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834212, "uuid": "b111bf10-c009-4c49-895c-58e818d95efd", "comment": "Malware payload (GCleaner)", "value": "4540354c20d390fec76816d07301c1c8c9b2cc99f80623e3f097c908eda4fac6cb75eee3fc49f12a1a9040f58ef3a0ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834212, "uuid": "99cb77c8-9a15-4ce6-86bb-b4602984e758", "value": "T1EBC5123CB105C5ADC280FEB4CD3AA4E75CD76EE3A990A42270DC7F3F517A289961A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834212, "uuid": "65bcf042-1a48-4c4e-84da-2bf6242a8b1d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834212, "uuid": "9e961f61-514c-4cd8-8c66-821194015fd2", "value": "49152:rdHyxtn70TbPPnbIBnNfPfprhS5y5Gi2F0DlUmbiqghRGR9zGwLLCgv2MR:JHOmXPPncNPfCUirSiurv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675834212, "uuid": "8ebb8ad6-48d5-4eed-9d31-740848c85af1", "value": 2674670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675834212, "uuid": "bd673f6f-e7c1-4a6c-a6f3-8c7ef232223e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834212, "uuid": "3ad30723-587e-4109-8144-d1dc4d155d32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577cbcb6-a7ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675865429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865429, "uuid": "2ad6bfd8-05d7-4367-a0aa-03f648f962f4", "comment": "Malware payload (AgentTesla)", "value": "6f2050f5099dbecc5ccd1fe462d7b8c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865429, "uuid": "9ec09e7b-9911-4d7b-be3d-d814d0482d88", "comment": "Malware payload (AgentTesla)", "value": "a748dedfcbbf581bcdd57370ed9ac6166a9d9103e6c85530073efbd8d6b4654d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865429, "uuid": "8c25c0de-8981-4b05-af20-803bd7569967", "comment": "Malware payload (AgentTesla)", "value": "1ac4cd9d1b731e54cd13ad417e5e49950be87d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675865429, "uuid": "e5258af1-25f2-44bf-a07b-df56ddb7636e", "comment": "Malware payload (AgentTesla)", "value": "b9ccf4721eb5e398304c87673e220999480d94b7207d86334f811ae6203cb2d10bdc052b751c8ce2998a9e9758229518", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865429, "uuid": "d5264321-ed8e-4aca-8109-775ab6c97717", "value": "T1A9642326A6F4C5B3EA6243314DB857426D96FA5718B5ED0FA7305F883A23020EC5F343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865429, "uuid": "ea22e3ec-9d84-4521-883e-9dc8ecc5398c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865429, "uuid": "5fd57576-6186-4598-812c-4b1386731da8", "value": "6144:PYa6oufIIAWxOQMYHD/BtzJppEyx2Mop1RhCowS6ZstKN0raRlM+7+:PY+ugINAGJ3pXop1a5XZUKiQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675865429, "uuid": "3a0b87b0-4a57-4df0-a4c7-9e8d0477057a", "value": 322941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675865429, "uuid": "543ba082-6205-4ed4-ace7-d3ae289fddcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675865429, "uuid": "1cba8397-46b7-4954-bb12-a5e072e57cac", "value": "Company Profile PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fe5054-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675881264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881264, "uuid": "b8f1e12c-6f24-4176-b598-b597e6dfde6b", "comment": "Malware payload (Smoke Loader)", "value": "de2cc5ab0c1b901b1d57a0e10c0185be", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881264, "uuid": "77b98063-0cf7-4a3b-ace2-0dae77dd43ee", "comment": "Malware payload (Smoke Loader)", "value": "a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881264, "uuid": "cf12f9bf-28f4-474b-8c20-16c4f6fd9e8b", "comment": "Malware payload (Smoke Loader)", "value": "f7d3144acc8e7473b8fb0c93cdc69632ea2de3ac", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881264, "uuid": "e36ccbc1-057f-4fa2-a2be-a30acef6c5eb", "comment": "Malware payload (Smoke Loader)", "value": "93e7f865153fa957e7b3221bd12b3e86a8dd2e1293e4a4ee08420ea992ba1fd76b3d38c32ca2f1cceff2a1e7cfa3973b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881264, "uuid": "6d31e8bf-7866-44e5-b9c0-5b4e873e334a", "value": "T10614C0323690C072C57B2C304C70DBA57BAFB93055B8996BF7A807AD5F707D1A636286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881264, "uuid": "c24f0677-2819-447f-954e-c13ea82a4c3a", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881264, "uuid": "0855325a-2ffe-463c-aba8-1b583eebb41b", "value": "3072:lSbONVWNIbrL8vTk1Wi5XiKR0Cf6MzjN+C1HQJISv5f9juaQE4nL:lSbFcrL8o1fikjNzQJn51juaQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881264, "uuid": "01c5da7b-31b4-478a-a827-8e0515878b28", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881264, "uuid": "687144d8-3820-499d-b3a1-ebe8cedfbf94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881264, "uuid": "46cac6d3-0f3c-419c-b5cb-29883802fedc", "value": "de2cc5ab0c1b901b1d57a0e10c0185be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354a6655-a7c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675870525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870525, "uuid": "41f8ccce-dbfc-4d3f-9744-d1123710b9af", "comment": "Malware payload (SnakeKeylogger)", "value": "924af368f685901a7b0de2f91b7d1cf4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870525, "uuid": "958a438a-5c90-40f5-a2bf-25f649f114b1", "comment": "Malware payload (SnakeKeylogger)", "value": "a7614fc60dc6d7a6e65657d39b14ed933ae3fdfec08f53449bc55368f5df1d6c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870525, "uuid": "0e83b63c-8d1f-430f-93d7-97ffe31bcd15", "comment": "Malware payload (SnakeKeylogger)", "value": "41812cad0eab6829e8f7425cecde71e00d850d1d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870525, "uuid": "4c4643bb-d5a6-414c-a420-57e41bb2eaf0", "comment": "Malware payload (SnakeKeylogger)", "value": "35b35cbcb91df7c74adf1cfed18fbde4b2e085a898264c7c05bbc4860e8b3c6f76d7271991f51ffd7944f5cf45724399", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870525, "uuid": "c09933d3-d498-4a60-9572-76d8f9de1bc8", "value": "T1BEF25D1AE79E02A8CF510273271B1A899ABDB33DB35154B1345C933433EDC6D46BA6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870525, "uuid": "3a0a655f-2941-4872-8ac7-14317c5202b8", "value": "768:OFx0XaIsnPRIa4fwJMELWR4gjIIo6d62IX:Of0Xvx3EMELM4gs1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870525, "uuid": "631165ae-9e8f-426c-b539-80f10ac15c32", "value": 34878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870525, "uuid": "6fbaad2e-9376-44cb-b9b4-686f77a809e2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870525, "uuid": "1311dddf-fb9a-4e4f-83f6-e990605c3147", "value": "specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c410a6-a758-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675823602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823602, "uuid": "430d85f2-f8dd-4f7b-82eb-c45a5c7a3680", "comment": "Malware payload (RedLineStealer)", "value": "de3fe6a5705ae7953ee1184dfd3fded1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823602, "uuid": "e02a30e6-e06e-4f03-b8bf-3ccc3bcaf50e", "comment": "Malware payload (RedLineStealer)", "value": "a77bcaa2621643cf9929fc1d89bb94002a057f79cb9f06aa8f1f608e1404d3d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823602, "uuid": "b22ae919-42d4-45ef-8a57-c07abd4afd38", "comment": "Malware payload (RedLineStealer)", "value": "2d67dde0223f15b94b6e518111fedeb3a41d0265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675823602, "uuid": "8742e740-9424-41b2-94fa-5c574c4cf9ec", "comment": "Malware payload (RedLineStealer)", "value": "3ae3725dc0d748e8d80baae8b48ac5d7729cb32ca7ee6b1938fa6d287bffe99f12a4fd736bde3b11a2d3b70202ac8478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823602, "uuid": "32c78e61-346c-46cb-a916-9700274289b0", "value": "T1116401323EC0D1B1C63225345C60DB60ABBE793059B9C9537BA81AEE5F603D1A63B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823602, "uuid": "5820967e-ef5d-435d-90be-21dc05e9dd91", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823602, "uuid": "cbbeb142-47b5-4726-83ba-575a49b4e98d", "value": "6144:TfIcUAbLsOOb7PfHUdfiPPbZ1PxcibttPv0w+HNrtm:TfIcBb4OYP8ZcTFJMHtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675823602, "uuid": "5133550d-afda-401e-89ce-43af773785b9", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675823602, "uuid": "0aaf64a1-3ce2-4c35-af0a-c1502d1feadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675823602, "uuid": "664cc112-1acc-46f1-928a-52a79404776a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2c7210-a794-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675849302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849302, "uuid": "53deeb05-6211-4b74-9416-aba4476aed39", "comment": "Malware payload (Smoke Loader)", "value": "b1d405973a01f534b4a35721127c3ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849302, "uuid": "01bef36d-80de-45e4-bdd3-91677395d818", "comment": "Malware payload (Smoke Loader)", "value": "a780df682e35349581005e2aa0acadeba4ff43d0eccdc4f3998490c3981f6881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849302, "uuid": "015024c9-0157-4fba-abd1-cec6a7ff4f5e", "comment": "Malware payload (Smoke Loader)", "value": "7d73b5fce76ff84e4032385999700cf93dfae0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675849302, "uuid": "80d0f08f-584e-4115-8aab-befedfa9565f", "comment": "Malware payload (Smoke Loader)", "value": "02ce5fc2a9e76146a35c8d39c7ae530f5d342fc509d3486b431d6d01b4069ce6f414b002710801fdebb61f32eeb7e9a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849302, "uuid": "0e921114-a983-4a65-a2fd-25ef8d2536a2", "value": "T179644B53A3E17C48D9258B33EE1EC6E8F60DF590EF5E37693218AA5F1872072C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849302, "uuid": "979f1ad3-6f7c-4ac9-b1d3-5261dbfe242a", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849302, "uuid": "4480fd47-0f21-49ad-83f7-513b6726aaea", "value": "3072:ew+qQ/AFfyXR5m5reQ2eXddhlGfcXI9gj3C2EVPV4WByUAl1c8kBW:e3FK+mVPNdDoMIY3C22OWUjc8kI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675849302, "uuid": "5420b966-5c8d-492c-a632-d0726ea87bf7", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675849302, "uuid": "4e20c0be-af12-4ce0-9659-b877059b6a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675849302, "uuid": "0b77cf1c-e7e6-4e39-891f-a43fd40ac5a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d5eab3-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675881448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881448, "uuid": "aad0945b-4b69-4ef7-8352-f7eaf4fcba07", "comment": "Malware payload (Mekotio)", "value": "025bbdef6f92b45631344bd9affa51d2", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881448, "uuid": "5c19a6e5-9256-45ba-80f6-f4e2a0585ef2", "comment": "Malware payload (Mekotio)", "value": "a7bc65dc16eb4c1a40ce37aacb8f2efbe613d25dee7e996b7baf579213d9fc46", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881448, "uuid": "02b06f6f-fc1b-4436-ba84-9a4cd258c34c", "comment": "Malware payload (Mekotio)", "value": "20f28f94fd3b79c3b6a114d9cc45a73bc5d07cab", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881448, "uuid": "33b93fb3-ed4a-4a1a-a6d2-f98452453e4e", "comment": "Malware payload (Mekotio)", "value": "506800bd9893b387795444c5f7e0a8a61c117f650214cba7ce8ba5ff7c39473de8e74cd1a0d6af64069374e8be53a2ee", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881448, "uuid": "89903858-b1ff-4823-b619-ef49fd19e3d3", "value": "T10676232273954122D0FEC6B80A27FFE560F62729976350BB66845ECE35F26D05372E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881448, "uuid": "3e5202c4-98fa-4ef7-ab71-f2c5f51225a7", "value": "196608:vAWjuxRAzk7c7tLJZAx99l1FBSBsdQmxxcP:vAguxd7c7tdZ+99KWx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881448, "uuid": "af234cab-6215-4266-beb8-390cd7efe552", "value": 7456256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881448, "uuid": "0ad94a23-3965-4445-8fe2-115bdfb12a31", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881448, "uuid": "19a4f03f-fed7-4b19-aecc-7816dcea9f29", "value": "FACT63e39.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d989b5a-a7bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675866325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866325, "uuid": "80e58818-18a8-4a92-af2a-687ac95ca23a", "comment": "Malware payload (RemcosRAT)", "value": "c45fe13a7d5c10f240108d3786912fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866325, "uuid": "80ec1b1e-1070-4321-bcdc-91d01e99486e", "comment": "Malware payload (RemcosRAT)", "value": "a83d25f3d81fad7452c41cfd2ae067dc47eeffa04b21d9fd515d0d95a6876eb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866325, "uuid": "a70802ce-7fb6-4cee-bbe5-7e3bb63e08d2", "comment": "Malware payload (RemcosRAT)", "value": "697a6119f6dc5a6a31a88e43d21b1d09c82d55dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675866325, "uuid": "3e1edec8-9215-4c38-b67d-6a761a0881b2", "comment": "Malware payload (RemcosRAT)", "value": "233a8a6caaf8fadc0e1314e9c629d3644398a743a364e1ef84679546406b453226f69be47bd75b40316557af8f774c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866325, "uuid": "76b9fa6e-77a5-456d-b5f0-d08cb6fc808e", "value": "T16E555FB454BB45E9E00FCA501BBCFDE901B679F3CCD60DA5836C76041FBAEA46E8450A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866325, "uuid": "d78a9711-f7fe-4ba7-aaaa-60e53a3019bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866325, "uuid": "053561e3-2a53-4d23-9a18-96c52654c54a", "value": "12288:hqgBqM4GDwz7FUNfIkCsBNokRolBYHnlV1NZu9+0Z2PCZGRsHjOZF0pSfTWcivYF:VV1N742goF0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675866325, "uuid": "149e6df7-7063-473b-9cab-be04803d7a38", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675866325, "uuid": "a44db377-880b-43cb-b58b-ddc22a5a66c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675866325, "uuid": "dbd947be-8962-46c5-8de1-8345347569e6", "value": "Epiajhnsyxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0581062-a76b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675831674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831674, "uuid": "9dfa0ecb-21ce-4fba-8808-bddabbb5aefa", "comment": "Malware payload (GCleaner)", "value": "1b56da8ec7b323272272eebe3e38ea2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831674, "uuid": "42dacb6b-f907-40b7-82d8-d9e813bc4eb3", "comment": "Malware payload (GCleaner)", "value": "a8585b6bb833bf9658e1371e97cb2296729511bbd118bf7f16a52050e559c7e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831674, "uuid": "d289fa2c-eed2-4586-97da-6e891524fcc5", "comment": "Malware payload (GCleaner)", "value": "88ea453233452eca10e12b161f46b196fcda7986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831674, "uuid": "c4d8db00-af4e-47d4-88cc-ff287dd33b6c", "comment": "Malware payload (GCleaner)", "value": "6cd28db58e32edaa317b5b1591ac95a9fcd77cbce67f3964e0e3c36cc87dda2ba91f18df790d6cbd8874444604d489b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831674, "uuid": "994b6251-5218-40f9-8ee2-a54a79db8cdc", "value": "T135C5127D7555C8ADC280FDB8CC3A95F36CD26EE3E8A0942270D97F3F52BA1885A09117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831674, "uuid": "ebcd87ea-9e6a-4141-bbfd-471a1e5683d2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831674, "uuid": "18a8ba62-9a9c-4366-81f9-03aba6f4631c", "value": "49152:pEHCPfHsblZCQyvH6EtxUrSG1ICKaJNXQ6ZsBhd28PfV6Snlm86LCgv2MR:6HkHsxZkUSYJNXQ6ZUhN6SndSv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675831674, "uuid": "679a92cb-eb5c-494b-9759-cdf3275a24ef", "value": 2666783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675831674, "uuid": "af41526c-c005-4f0c-bf70-ef13c087c997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831674, "uuid": "7b02049e-eb8a-4bef-a0fc-a54e3eacc684", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7b305a-a7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675859610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859610, "uuid": "4307ea26-7782-449a-9286-a37f5aab8edd", "comment": "Malware payload (Amadey)", "value": "5f15ffbe3239352d58022b9222d615e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859610, "uuid": "f1d340b6-6ad7-470e-b73e-33619e1f470a", "comment": "Malware payload (Amadey)", "value": "a8e1f0bee19187782824d457b510e65a6120d353321a157a47a2bf57f7684725", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859610, "uuid": "3e269744-31aa-4e11-9422-83fadc50e7b7", "comment": "Malware payload (Amadey)", "value": "369d1a76ee0bdd27d6c6014a5723192b99d1490a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859610, "uuid": "f1813d70-6dbb-474b-a57f-4fe118f06226", "comment": "Malware payload (Amadey)", "value": "c9bcbd23a5e2956197888fdaca6b2a40e5b7cfd8cfadf34e22f7765d7b7d83943a931fae1f470d00ead8ad3e57cd8478", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859610, "uuid": "9c037e6c-0709-4e80-acbf-6ab23bef301e", "value": "T150C4020BF7E89133E9B457B009F603A31A367E906B788767524F6C0A18725F0A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859610, "uuid": "dcce5f27-5786-4033-9901-36159754c83b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859610, "uuid": "42a5a20f-efe9-4af6-ae31-2d2d221e053c", "value": "12288:jMrsy90iYsuodeXLRzNfKy8biwQSJoYUxdhq4YkCPxZlBAJaCNNG:vyGs3dOc/ihSJnUU4Yt/BW/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859610, "uuid": "da8d6057-1918-46ea-b9e4-2073e7d952a7", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859610, "uuid": "71233384-eeb9-47de-8dc3-113481c19e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859610, "uuid": "63229f7a-114b-41e4-974b-c01608efcb8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babfdf91-a7b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1675863018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863018, "uuid": "95e6b5f8-7b41-4566-a95e-047414387c6d", "comment": "Malware payload (Mekotio)", "value": "96fd75ba1ffcfb508ce6478204361182", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863018, "uuid": "aadcdbed-b68d-49e5-847f-0da0dec9ad1e", "comment": "Malware payload (Mekotio)", "value": "a8fbbc85407bec0915712ece7f8a4147e6daee52bf2d5440e3b7546fc4d03f56", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863018, "uuid": "b5720363-33fb-4663-8d1f-abdd6d951ed8", "comment": "Malware payload (Mekotio)", "value": "b8109eac62cd4c69aa8523a7e39028631fe2f6b4", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863018, "uuid": "6f535fe4-4daf-4a41-ba5b-37bfab600700", "comment": "Malware payload (Mekotio)", "value": "38cbecf93da58d670f190241d8989b37bfb30ea9f92dc0a5753ea99c5d226e918a31c3b483360fea66b5ec53c785360b", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863018, "uuid": "cdddf499-c9d4-431c-bcab-39e351847ab9", "value": "T19CE63304399D27145E76130C5B72387B0615C15BF5BE2ACDAEC2B6D8BAFB8612C58B3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863018, "uuid": "94060069-0db7-4108-96d7-ec94fe23ecf7", "value": "393216:wKhYJpBZm3ivAhmwGATLVKNrjhjKVgc/awYIDG:jQ/ZVv4XdsUgc/aQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863018, "uuid": "8c5d9d7f-c000-4ace-a9ec-d0bbab679a79", "value": 14629267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863018, "uuid": "394357b8-84b2-45f6-a9a7-49e01fe06086", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863018, "uuid": "da9a7a92-f2c6-48df-9a16-2a257140811d", "value": "payload4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28eb209-a7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675869554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869554, "uuid": "6f9df38e-799f-48f5-b7f7-83e45717c677", "comment": "Malware payload (Formbook)", "value": "7d27f673e83e0c656871292ac1dd41e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869554, "uuid": "08e91b23-f14d-4062-9e66-9a83a1acb92b", "comment": "Malware payload (Formbook)", "value": "a9351b9b74ef0244d678c907db4003e2a7a25f5678cc540b9e65615135958737", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869554, "uuid": "858ee991-1650-4f43-8105-305e049f83de", "comment": "Malware payload (Formbook)", "value": "a3986c181bdf383f2d64ad9167e801c35cdbb8c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869554, "uuid": "31b3fe43-07ed-4a17-aa6a-22d113866bbd", "comment": "Malware payload (Formbook)", "value": "2453c01896a39cca5c404018bfd777c10f09b8756e2de3ced216a1b59bf7af881b51b3ef022ca9caa3faaf84aeb4bd02", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869554, "uuid": "2064828d-8c44-4c29-bd2a-4030b5f9d1a6", "value": "T1D9741290B794C86ADD600472156892366BA7AC3668BA5D4F379C370A7B33183DE2F713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869554, "uuid": "61b7ed50-a6b1-4aec-96f5-7a5f1060ecc0", "value": "6144:KYa6FM+2pDlj3uGJpZrJ52Gp0yK0Iqbu2Cz99Dzr2Oc:KY4+21lruApZNP0yXI6u2CzPeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869554, "uuid": "3fd3bb72-ae29-42af-8aa8-2b371f3f817a", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869554, "uuid": "1e18bb87-59ce-4ae0-af58-835e38fbfa1d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869554, "uuid": "180fa25c-a524-4baf-a397-c08bb7bab75d", "value": "HXM0300550018.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275572da-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675858905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858905, "uuid": "70e5f1f4-ac90-4582-9404-12584c946e2f", "comment": "Malware payload (Mirai)", "value": "7000b866ec6ad742342484a57cdcf5f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858905, "uuid": "fc96fcd1-9308-4963-85be-b7c9dcba68d4", "comment": "Malware payload (Mirai)", "value": "a9cdd736b9529de717bd806466c256b724ab6238985811bc99cbe08f8518e12e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858905, "uuid": "0d80645c-4db6-415d-9767-53e65f503b34", "comment": "Malware payload (Mirai)", "value": "c8974eca4b27207dc55c2fd153db4ff2631a7acb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858905, "uuid": "2453a793-403a-4235-9fba-8b96b89afa41", "comment": "Malware payload (Mirai)", "value": "a155c53b3eb1abda68286e5b1c94c8c045bcc4b9b437c94fd6ff3528d89bbd5ede2ddd2930a0544e4593c0b2b2f84560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858905, "uuid": "b0cfd2e2-6997-4e4b-b935-e098d495ee53", "value": "T106C2E1B0E44C0EB7ED2BE675CE40DDF876072E5B25D38AE6B1C1A61A05E5931C3049D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858905, "uuid": "2b340385-2f98-4d65-95ae-3c8f4754a431", "value": "768:zuxqNa7PqLefxslAcKm/2CTVLP1oN/DR4uVcqgw09U:dNLaxslx4U1oN/d4u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858905, "uuid": "0bab2046-e028-4759-a58e-cd1732087c25", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858905, "uuid": "ad59fc3c-060d-4e8a-a176-c911e987e13d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858905, "uuid": "f8cbb336-54d4-447b-859a-acc21630521a", "value": "7000b866ec6ad742342484a57cdcf5f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7406ba-a7e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883796, "uuid": "cb04e592-8937-4aea-b336-bea7289f0769", "comment": "Malware payload", "value": "b2d439d5544993b05ca83b007305e9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883796, "uuid": "89f264ce-6e60-4295-80cb-78a4bef0b168", "comment": "Malware payload", "value": "aa0fced9557ed38e8352fb4372e321c8e8fba18f47d71b0ca521c71508cda369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883796, "uuid": "260359a5-f0ea-4237-8fa1-0e438eb555ec", "comment": "Malware payload", "value": "ecac244e6a2cf3ddaf0eb6e442a1c648640081b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883796, "uuid": "ffd5bc5a-820b-485b-8e5e-f425924c000f", "comment": "Malware payload", "value": "e865500a770b98ecf78adc7bff2d547df6fa8a39ce396ee82773b6bf5ce46ccb9b7c1906135646464e92d403fd1e2d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883796, "uuid": "f9a6881e-f9b4-44ac-8f21-00d6b79ea646", "value": "T1D9C5123C7205D49DD680BEB4C92AD8E75CEA6DE3E9E4A05370C9BF3F527D1885A09207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883796, "uuid": "a4a3a6a4-ad3c-41ce-8e53-25e32fae02b8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883796, "uuid": "105659ef-e910-45d1-a38c-aac561671fb0", "value": "49152:rdH2ZsSVUZOyckTB0YEOODyF/peydjASSIqll40Bxno7kC5yuLCgv2MR:JHYUs3KmjvelpeekSvq75Bxno7kC57vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883796, "uuid": "38595887-8304-46b8-b402-6b91994bd795", "value": 2700533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883796, "uuid": "086ec671-833f-4511-a2de-2325e68cc35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883796, "uuid": "92379d76-5ede-4049-8645-ad69f2dd4ebd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3eadaa-a7ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886237, "uuid": "3b0bc5ed-8293-4b38-ad2f-cc80fe10e155", "comment": "Malware payload", "value": "478f5deb6390dde5db7787bf5546a39b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886237, "uuid": "eee8d7d2-6f0d-4fd6-9e90-eb69c5b47955", "comment": "Malware payload", "value": "aa54f6f9ca968f35a7d61cb858bf491b50292a7424dbd3dc23ed5efe325e5dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886237, "uuid": "ec09a0a5-3d3d-417b-bc05-9a955d0c4341", "comment": "Malware payload", "value": "609cb9fd8e127fb8a9042fef1e3c05e28e45a696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886237, "uuid": "1fcba0ad-4cad-47b0-abd4-a7e8260edfa1", "comment": "Malware payload", "value": "a56a571dcda0ffd5d15bb55455c5847b8fd81717dd29e9ba3bc188f53b5452638a1efe68a8dc7e865cdb882b24a9b5fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886237, "uuid": "f0e594f8-2d45-4fbf-99f0-ffe951cbb548", "value": "T1CB640803E2E27C81F9658B769E1FFBE8765DF5608E4AB7653218DA2B14B0173C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886237, "uuid": "2e3c7215-05f0-45b9-8ec9-a55e548d7475", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886237, "uuid": "48629f4e-63ad-4276-bebf-095216394045", "value": "3072:/Pg23MzddxR9RCKhU2VRZBnRY44qfqZLFVsWQDiuLpFgv:/BYrRCK20RDnRYz2sFSLiq+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886237, "uuid": "5917db3c-87de-40e9-9f0f-6a559ebaec4d", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886237, "uuid": "2f68ce31-12c4-4e56-9614-1ef52ae8b846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886237, "uuid": "facfe740-5bdc-400d-b575-1cc4194938d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93971a4f-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885286, "uuid": "56a74bb3-56ea-4fde-b8ce-875fbe2b59c9", "comment": "Malware payload (Mirai)", "value": "4ed8b6a4e72967b470950f278778d1c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885286, "uuid": "6b117318-d59b-439e-810b-00ee0c71b0e3", "comment": "Malware payload (Mirai)", "value": "aac8b5ce7951cd61ef7a9229b755645de64f34f2af9b72e8b40cb10aa8dfb021", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885286, "uuid": "7fee63dd-dc32-48ac-bb30-879ef04696b9", "comment": "Malware payload (Mirai)", "value": "e4621b8a29a63e16fd79dcfa9d30b76f8cc63bd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885286, "uuid": "e32dff97-3c94-4d61-bfbf-1d40395df96f", "comment": "Malware payload (Mirai)", "value": "a76e1c33beb3ef8e4588bf2d697b2bc61dc702d9f866f7ae25de8029fb45377f4f834d0e416804a3f19085a8b7ec235e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885286, "uuid": "644d0418-dd7a-4316-b267-51293cf2b8b7", "value": "T112730856B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885286, "uuid": "afa64fcd-6387-4560-bd74-f66ca45a632f", "value": "1536:2lnHaxP6XkC/zTkS7IDHtdMwo8XG2ta0J0GIgi/z3KvcIc+5UYIWjz:nxiX1Lgbtdb1tabz3KvcIc+uRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885286, "uuid": "4b71490e-66ad-407c-997f-1cc7971e9cae", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885286, "uuid": "b7ebc343-2d5a-4d89-95fe-44f85a3a3b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885286, "uuid": "46aee4f9-59c3-4698-81ec-f06da5a14719", "value": "4ed8b6a4e72967b470950f278778d1c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3493f1a3-a7fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675894146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894146, "uuid": "feb2c910-4209-4877-a13c-973f6a76c437", "comment": "Malware payload", "value": "261494f4348e3fb377541b69dd8e1fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894146, "uuid": "ab1ace36-b441-4bc5-b052-05bf14a5d134", "comment": "Malware payload", "value": "aaf0e19251f32e1efab5dde8e2c52e657641980fdc28e304cc84ed2f331358be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894146, "uuid": "786dddda-3b74-4438-a3d1-ddfbb08192cf", "comment": "Malware payload", "value": "ae3d392a4ff36c3253e9cbf58c37931dc16be6e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675894146, "uuid": "0bd2ead7-b110-4e20-b0a5-bc056a0b9602", "comment": "Malware payload", "value": "413cfdd4ea4ae91b5ddcab97a75b773f2e80c7635e8180c37ece1f6d1cacf3cc252e4c0351b8fe6432ab43fafd79d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894146, "uuid": "daa688d3-9e7f-4435-a449-fcab9f9f2305", "value": "T16FC40207A7EC9073D8B457705DF602D30636BE516F3483E7224BAD0A08B36E5A63676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894146, "uuid": "955309f6-7058-4b60-a5c9-c19bc26c27c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894146, "uuid": "3e71edac-a353-408d-8cf5-8d489c426db6", "value": "12288:NMrzy90YTlWgZOHBY46TjS1+4oqh6NCfXi03NlV3zU5:uyNlBZCW46TG1+4bAY/iKJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675894146, "uuid": "50704462-1b29-4ba8-818c-6dc53bc540be", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675894146, "uuid": "e0f1fd56-6321-4649-9d79-4b3a8819e413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675894146, "uuid": "28eae503-3734-4f17-855c-7b0972b9f9f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7a724b-a7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675869272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869272, "uuid": "40494103-594f-4f50-b645-82ad603f224e", "comment": "Malware payload (Amadey)", "value": "21f22ff930e339109ed903a6c7d697cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869272, "uuid": "8f6cec99-1337-4eb9-a12f-1d1683bccd7f", "comment": "Malware payload (Amadey)", "value": "abf1f196bc981bbe4d738f26ae4c4a6393c9af284e3e7982c0fbc26c70366229", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869272, "uuid": "681b3a38-93b8-4f56-a238-dda10a032ce8", "comment": "Malware payload (Amadey)", "value": "bebe5ce68a5f732e84cdeeb4f1e0d0f1ce15bf1d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869272, "uuid": "6d233625-057b-4e4b-8ee0-82c9453c8b3f", "comment": "Malware payload (Amadey)", "value": "e22b32aa3adda5cfacea1f04b56fd4cbb351e3953f0b8247fa563a0f08d1f0e491d3fc6eadb03af254536658c702ce84", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869272, "uuid": "868f9c00-37f9-4fce-9924-49c5529e2710", "value": "T117C4120BE6E89436D9B457701DF703C31E367D605A3882AF335E9D5A18726B4B23136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869272, "uuid": "25b04011-1e6d-4cfa-bccd-9e7b4548f812", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869272, "uuid": "70521ebb-bb66-48a3-a628-6e2aa653be83", "value": "12288:kMr9y90hNyVNuvwauf8a86c0lHKeqoBEMwrzK4R:RyKgVKwaOa6c0JqoBEMieA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869272, "uuid": "1b91d88d-b399-41c5-a0e9-e2c25b35c7af", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869272, "uuid": "99c3579a-979d-4e02-9f61-7beee639260f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869272, "uuid": "2db7feb6-198b-493a-ab5a-5342f60b3a27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0ad5b8-a806-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675898316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898316, "uuid": "0cbdf740-03e8-470f-9898-770b07568220", "comment": "Malware payload", "value": "5d7e4279e59d32f15140b8fac2d2bd92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898316, "uuid": "ed7bb1bf-c495-4e05-9c42-95bb50c95978", "comment": "Malware payload", "value": "abf78a7b63075b2d61a80c9b0fe49fb0a0265043a96c5fe795b2f2e1e00d304c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898316, "uuid": "8873dbcf-7428-4922-8e0e-d6bab94ff7b9", "comment": "Malware payload", "value": "5ad1bdf1a236ff1539348671218a546e8c9c4a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675898316, "uuid": "c74a6d29-451a-472a-ae6f-2ce04922dc85", "comment": "Malware payload", "value": "23a674f6d89a05fb8196cd4777d37fe72147dcfc2145d48c0d0813ecebac5e2231a54ab263c2ebe1225c683841ce72b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898316, "uuid": "d325aeb3-d247-4c17-afbf-0267eeb2a7b3", "value": "T163642943D2E17C82F9658B76AE1FFBE8765EF5608E4AB7653218EA1F14F0072C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898316, "uuid": "cfaf17ea-6eb7-487f-a085-804f8c6c8480", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898316, "uuid": "3b94c485-612d-45db-a8ff-ba2e7606a5f8", "value": "3072:cPg1nwXLn5RFiTAmZTBjCGt+WPftoInOTsWQDiuLpcgYrgvG:cykdaAmZT1tZLOwLiqczkvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675898316, "uuid": "08c93383-677a-4b58-9ac5-12fe6a29d12a", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675898316, "uuid": "4c860a09-6272-4884-836d-124661208c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675898316, "uuid": "5292a417-ac81-4ad5-a4a5-3da374549d89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80da41b3-a797-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675850466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850466, "uuid": "3546ac61-024c-4ac4-a1bb-3c428bbb45f1", "comment": "Malware payload (GCleaner)", "value": "633a3971dd3cc89e59681df3581614c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850466, "uuid": "f81b9583-c49d-4c06-9336-a81998398cf9", "comment": "Malware payload (GCleaner)", "value": "ac588c31092cc07726e9ec4580ac6530758fb442424ed74b061f1512fc7e3cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850466, "uuid": "dced4c52-3811-47b2-b3ac-242e7f5f4466", "comment": "Malware payload (GCleaner)", "value": "386f16aeaea9e061199dfbb6c9ba7741f564cf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850466, "uuid": "dce3f2b3-1c7b-494a-9407-c547e12b1bff", "comment": "Malware payload (GCleaner)", "value": "d7426a2b6a92c557a68cf89ac97128e3489cbb2db577f54f2282064155bd348c4be1511d3a93640043ae2da70d864c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850466, "uuid": "6c74d85e-e95f-4ea9-b54e-9efce65745c2", "value": "T125C5113C7109D96DC280BEB4883A98E75CD76EE3E9D4A02370CEBF3F56792955609213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850466, "uuid": "e4096a2d-9119-4783-96c8-36d17e506cd1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850466, "uuid": "ab038196-ad11-4c58-955e-bc6f146888fd", "value": "49152:rdHhZtGHljYIAg6bc3sXZhL5FQiSaANfK/nO0RazHX2LLCgv2MR:JHTtGHlBp6rPL5nAVL04HX2/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850466, "uuid": "8fad06b7-bd2c-4c2a-900f-03ec46cb8944", "value": 2668807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850466, "uuid": "b6f94025-37d5-49ec-b57a-e9811494f324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850466, "uuid": "43e2b947-3fdf-4a3d-8574-c86762add5ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6668ea49-a75e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675825940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825940, "uuid": "bb7dc047-b545-446a-8873-b480bfe0b290", "comment": "Malware payload (Amadey)", "value": "f6445833da74752fa0a8f014b7b429af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825940, "uuid": "1c4e41a4-edba-4f3d-9cd4-07bc4772b4a2", "comment": "Malware payload (Amadey)", "value": "acb76defe054b1efda23ec54ea4ed38ababb0c0dcbf67e645f2a706216612865", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825940, "uuid": "8c8e55ea-bbb1-4d16-9b1c-57230406dd4b", "comment": "Malware payload (Amadey)", "value": "78c04b514808da46b6e46bb20fc316e9bb6b95e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675825940, "uuid": "0b718478-0a71-4693-9f60-2ed7bfee9209", "comment": "Malware payload (Amadey)", "value": "7e0e1076dce3c82dc845a88c736e5f2eeb3754d0fd45a04b17b98422e3732207638263e1d3fecbc14142055159b75fa4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825940, "uuid": "f816976f-2ac9-4ca8-939b-02b0c76cbc26", "value": "T181B40207E7E88032D8B41BB005F603D31B37BFA15B35835A275A6D1A19336A5B276B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825940, "uuid": "b8eda4a9-08a3-4d90-ad5e-f6d071dd6007", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825940, "uuid": "c8a03619-b166-4fb6-9ac0-7fb733885a28", "value": "12288:7Mrqy90QKE0hk+btG64mIfnBhxprvKFat5IF:Fyvmk+ph4mIhxprv9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675825940, "uuid": "14ffa99d-e438-4fe7-b623-f44b1bf8bc06", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675825940, "uuid": "ffb4af50-c133-47e0-a89a-eac693c6ce8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675825940, "uuid": "4ed1c282-3962-46c5-bb2c-41cd69348c5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1b3c85-a77b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675838620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838620, "uuid": "018aeb01-2838-40b2-b133-efe7c113c193", "comment": "Malware payload (Amadey)", "value": "e361c799c221f5ae081dfa6f742091a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838620, "uuid": "2a5f3c4f-73a4-44ca-a071-639660936f0c", "comment": "Malware payload (Amadey)", "value": "acd536c42720f713f2cf6c82784a44daacd45eb8e56474c7eadd16028a30e0fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838620, "uuid": "18b74ca7-0d95-4640-ad86-742f3cf350e4", "comment": "Malware payload (Amadey)", "value": "a9ee397f5b46332856ab35972b053ec545e63640", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838620, "uuid": "ce8ffe58-4aa9-462e-8887-b720a409c005", "comment": "Malware payload (Amadey)", "value": "226786bd2d91432ecbbeffbd320f40767022ba994f2b4211a8204c03823d28be37e331cff75cbbf59544c8570b9950a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838620, "uuid": "71ab5a83-15bc-4d7b-9a19-64435a609675", "value": "T15AC40217EAE8D137E9B0637519F606C30737BD716B38829B268F9E691C726606330727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838620, "uuid": "524fad29-ef2d-45c1-8d20-d0a94cbc15ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838620, "uuid": "1a11477d-ebc7-4b61-862a-078b424ffe7f", "value": "12288:5MrXy90TYMJkTA/x3AppHu16Jvopkbwtx1pPWfd/F:SyMaA/ippI619JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838620, "uuid": "41f7e5e4-97d8-4acd-8d8c-7a96ab87d972", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838620, "uuid": "7175c9f5-337b-42d9-9fd7-9efc07e182ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838620, "uuid": "00b0047f-b1a0-49a1-803b-86c2d22b5d12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0baf26e-a747-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675816294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816294, "uuid": "615377e2-5e98-4c29-824e-3643c31d2550", "comment": "Malware payload (RedLineStealer)", "value": "550c4213e77ac2fb0e4efccad087a234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816294, "uuid": "b2a3c5c2-4517-4b74-9d37-dd0221365e45", "comment": "Malware payload (RedLineStealer)", "value": "acef0525bd3bb9af12bb6622cf88c55f4a963c81db0ad86a52d26f9cacd55ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816294, "uuid": "f7422553-9d94-495b-aa1a-a6f8f5f549d5", "comment": "Malware payload (RedLineStealer)", "value": "fa2c865446950312871d60713624e32fc5347bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816294, "uuid": "620d783f-caee-444b-b1db-f9e1f3b0454d", "comment": "Malware payload (RedLineStealer)", "value": "be86e5b7cf4d3deb93ac2d1134eae2f8082747e374eaed14357f0326c80b68875afd89a82333af9e0435a1bbf262cca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816294, "uuid": "983712ea-1988-492d-a0dc-fd2793a1cb25", "value": "T1E16402333690C372C6A714344C24CB649B7E7430997A9A5BB76B17EA5F303D1E93A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816294, "uuid": "5479059c-3699-4689-999d-4000227ac761", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816294, "uuid": "60a53ba0-95e0-4c75-9629-595dce8726ce", "value": "3072:efIOy4vqbWM/LIiCWca5x8GuulSBPOlonY/RUJBVmjasmHz94AVKrRmT8CYS5e4:efIqxiLlC+l62/MBVmOt4jmD35/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816294, "uuid": "9d3aa176-58b8-4898-9f5c-756088550846", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816294, "uuid": "6cc9d13f-3c2b-4f09-8eb3-73cf6664931d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816294, "uuid": "cc000c18-75f9-4c51-b44d-5f7d1bc7eb11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26c681b-a784-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675842442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842442, "uuid": "e1f499e9-206b-4c92-9dfd-65168990feec", "comment": "Malware payload (GCleaner)", "value": "2d4a2da50a1efadbbfbdc8d13d8a0088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842442, "uuid": "08433865-6faa-4bb1-b641-fd020cdc328e", "comment": "Malware payload (GCleaner)", "value": "ad00a0a621568e0540771f418433a062d141e73178059c009169255b0825495d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842442, "uuid": "9e3da38e-ea1e-4956-923c-6cda846441b8", "comment": "Malware payload (GCleaner)", "value": "75af17188e599b41053c11cc2844bd10c70b3fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842442, "uuid": "d7230fda-5e40-489b-a8dc-55e029a26657", "comment": "Malware payload (GCleaner)", "value": "fd45c6fad7a18de0d7b3ba6bac94d627d20a9d16ea05b5547f920b7eea9910122d418c882c48d85d2baa59c805027caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842442, "uuid": "b11d7531-65de-45a3-b315-4d38a042f2a3", "value": "T115C5127D7241C96CD290BEB48C36D8EB2CD76DE3E8A4916230CD7F3F51B92849A1A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842442, "uuid": "582fa28c-0e6b-47fa-9d3e-ff1256b7fce3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842442, "uuid": "a9caef44-34f3-4f7d-8722-af0a2f278b41", "value": "49152:rdHwFOmF46fTK+Vu7fVcMWRrz65NY7r97IeRk3+xRLCgv2MR:JHx046fFVuJqrmfYcS9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675842442, "uuid": "1ddee11a-4dbb-4e63-82f3-6b04db10c492", "value": 2698170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675842442, "uuid": "888e7206-081d-40e0-b762-e9fc3648c2e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842442, "uuid": "74c97606-8c84-454d-9945-5b8f7e81a181", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e2c9e4-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880913, "uuid": "05a26671-3ef4-4bc1-af6e-ac184ee528e7", "comment": "Malware payload (SnakeKeylogger)", "value": "46f65b2deb66134d1179560d484043b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880913, "uuid": "dd67a1eb-b4a2-4f20-81fd-d880424f9b05", "comment": "Malware payload (SnakeKeylogger)", "value": "ad1e4a02216fccadf1561c087639fe249e8e2399c27ae710bc69512e54e0f7b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880913, "uuid": "4fc7daa1-cb64-46fb-a1c3-0f097ed43ea1", "comment": "Malware payload (SnakeKeylogger)", "value": "554f9fbae4b1d75069eda4ae0925d2d468bc2ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880913, "uuid": "446eb414-ca5e-4151-b763-5e440c222095", "comment": "Malware payload (SnakeKeylogger)", "value": "a1f3d67724dc68f877a76cbad096bb01ea2df342ef2c6957d8c77908c93e60cc656781aa283d35e369b0e61d188a0772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880913, "uuid": "7e797b68-1dcd-45c7-85af-c324d68f896b", "value": "T1EB35A7203AEE501EF1B3AF799EE475CB9EAFFA63760694582054038A0B13B41DDD153B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880913, "uuid": "a2c7c14f-85d5-4c4c-a7d2-0e836357072e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880913, "uuid": "028bfa37-1690-4195-92ff-67ebe8829db0", "value": "12288:PDamuxS/jH8Prp/6+R4cSbEX7ULxMtdxXHZvn7fy1fV+MEhEh8OZJgSP8X5THRNJ:Wmux6jH8Prp/6+R4AI+N3FMTTA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880913, "uuid": "8920d941-53b6-4c17-b2f6-c48e48d21c28", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880913, "uuid": "8a145c87-e53b-4b91-90c2-b19c4411ba65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880913, "uuid": "af7adc08-bafe-45bf-8bb3-16f687819c32", "value": "DOT098764356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6ae27d-a761-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675827076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827076, "uuid": "da24534c-1e4d-4928-91c3-ec0e9baa7cb7", "comment": "Malware payload (Smoke Loader)", "value": "7f2d28e3c305aa30e921a8eb72a1300f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827076, "uuid": "15018894-737b-470e-916c-45e043a880eb", "comment": "Malware payload (Smoke Loader)", "value": "ad4fe097ec2c9bbe887da193a058407f8e1f48acb6323cb7470019c6c3d3dc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827076, "uuid": "35730c62-68da-4eec-8305-507d7a7db1e0", "comment": "Malware payload (Smoke Loader)", "value": "289d3bebdf2950ae5a32da78a6220df29c3ecd34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675827076, "uuid": "f062e358-c870-439f-a916-0122ca26028d", "comment": "Malware payload (Smoke Loader)", "value": "b8b493a29685ef4c5c8504e786df74bca8e363ccfd6cd4bb9463cb94a5d27ce77b3f59556a45be68abe2846f8ec0d722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827076, "uuid": "b94c08df-acb5-440f-8590-a8956a7468e8", "value": "T15714D0323690C032C57655346877DB653BBEB5305275CA7B7BA817AE0F302D1AA3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827076, "uuid": "a1a8c5c1-0d06-4880-bff2-ffd3b26445c3", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827076, "uuid": "d9274e53-0a63-4a69-acd4-ad9c00ae982d", "value": "3072:9GFOKPPi+auVLOSseWima5pFljx+9aV4CQwI:9GF16yLvseDFj+AGCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675827076, "uuid": "c6bffa12-c51e-42c1-9881-e370e62b22d1", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675827076, "uuid": "6702bd67-3261-41bc-8a97-78f2687f1e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675827076, "uuid": "ba249a39-8c01-4e13-9176-582cfe8db378", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2be7173-a78a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675844966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844966, "uuid": "b84a7b24-20ad-49dd-98e1-3f08675aa396", "comment": "Malware payload (Amadey)", "value": "64d18120bf7614580edd261807a7bda5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844966, "uuid": "0faf6449-5dfe-450c-a46a-4a6b24275b37", "comment": "Malware payload (Amadey)", "value": "ae812e2226e3b621a3dd2041b40963de6f1b29719bf0886cbd8d767d15a4a732", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844966, "uuid": "0297a2d3-1e11-45ed-95a9-ab36476cfd94", "comment": "Malware payload (Amadey)", "value": "58f23649cdf6eed2484e960f377fd19dfc097872", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844966, "uuid": "dba2a472-db5a-41e9-8a58-a896a6f2f441", "comment": "Malware payload (Amadey)", "value": "023cc2bec0c2de0cbaace0ca49cb92d7cea4482414a26625758471ace5b7c11d5f8c19a25f790b44c7e2dad49876a8a9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844966, "uuid": "826f9fa7-056f-45a7-ab89-6c054f4a9591", "value": "T1A5C4120BE7F84021E4B587B049FB02D30A357E556A7882A7274E7C5A0CB2575E7363B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844966, "uuid": "ce79e610-9964-4381-b819-87bd0a5ba4e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844966, "uuid": "9bc2f698-b728-4e66-a407-dca5f87d9722", "value": "12288:uMrTy90CX7eHY3SnPVQE6oRXIj62h456J+Pr3CzL6/3HkVTXbX6h:lyViQSteoROTMHGLS4TXL6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844966, "uuid": "8c7c4b50-a78d-4771-9c64-8d8ce10d6f15", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844966, "uuid": "688b9c68-c45e-4ce4-b20f-34f150ab2b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844966, "uuid": "bfafd9dd-c6cd-406b-8468-1f0bd38f8764", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc16b67-a789-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675844531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844531, "uuid": "b3b42fb4-3196-491d-8fb7-802bb7ee9898", "comment": "Malware payload (Amadey)", "value": "73e9e6a78eaa6069b084144594e6ee68", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844531, "uuid": "dff9f764-7c6b-49aa-9475-b7c7c1abe22a", "comment": "Malware payload (Amadey)", "value": "aee5f17d5da35018d77413c0f5dfc16c6c8d1508f4f0a51b91e1a6c67983218b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844531, "uuid": "c52dc016-e7b5-4bf0-a010-6126fbd2ab11", "comment": "Malware payload (Amadey)", "value": "d51b8aac26b21c4a26c75d2fd848418e2af9cb0c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844531, "uuid": "3a7f0eef-f496-4c8c-af7a-7c9ce16a9995", "comment": "Malware payload (Amadey)", "value": "1aa9384396b5c557477e954b90885a4b6e4965b171b278c1a3d56830444bdf9ce334a3414bada8e44c71e6a107ccd96a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844531, "uuid": "eedb5c8e-59b3-43fa-bc75-b2ea096a2092", "value": "T1CFC41247ABE98021E8A697B019F703D30B3A7D605A7886D7734B6D5E2C73270B271367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844531, "uuid": "1dcfa1ea-1137-4384-9d56-613e3ad5eeb2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844531, "uuid": "930fa6e1-4ebc-418c-849f-20274fd6e85a", "value": "12288:2Mrsy90GIBo9/JlSLXSj62y456pFPr/ebL6XssPkFsiATD:Cybuc/HScYM62LE3s+V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844531, "uuid": "a7978a3e-6639-4c90-8f18-0e815938c9d1", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844531, "uuid": "01cac2a3-7be8-47ea-abfb-4961b2ee1ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844531, "uuid": "2f578861-edcd-4c54-9e02-6bac6006dac5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45d015c-a7c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675870282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870282, "uuid": "0a03acae-ed5f-4b95-a476-c7736f366ff3", "comment": "Malware payload (RecordBreaker)", "value": "7b791872d0ff5bbf059e18bbfb97e7de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870282, "uuid": "6c44bc45-c752-499a-b795-89ae87560ff2", "comment": "Malware payload (RecordBreaker)", "value": "af33e596d0cc66da4bf5c1aab0f2a38e64b942fa4f871e6e27d58811c9d3c298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870282, "uuid": "f30297ce-6a8a-4436-a972-e93c262269ea", "comment": "Malware payload (RecordBreaker)", "value": "8bcc4c50a7b0b4ef4030c3c3b7762a0c1053e71f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675870282, "uuid": "424b4396-1de9-4bca-8cab-f83732952bdc", "comment": "Malware payload (RecordBreaker)", "value": "918df59fec751db49683dc0d52b50e82411e21b3d83ce9105f32fa4847e95e3e6fce924361c4674c00f3e66ecbaa1e85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870282, "uuid": "685229a5-16a1-4bd4-881d-3121a3404afd", "value": "T17D643B8397E1FC40E9618B73DE1ECAE8761DB5508F2E7776D2186A5F14F20B2C1A3291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870282, "uuid": "63bd53b7-59c5-448d-a508-964048248bf2", "value": "8c22d8e692fb0a7b86ba80b3104d1a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870282, "uuid": "dcc683a0-47c2-473c-813b-5955569fcd37", "value": "3072:SPB7tGIKRNH0xq56cue1lensVaGSRLStKRxhUwva:Sp7Y9Qcj14uaHgtKBva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675870282, "uuid": "f31b2250-c71a-4472-840f-35a65b0c74d1", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675870282, "uuid": "2992af16-5c76-42c5-9121-561381818f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675870282, "uuid": "2e4e9d7e-a1c1-4ede-acec-e5d772e2e24a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33fca37-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675882360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882360, "uuid": "973dc201-3070-4714-891f-305e8773ae11", "comment": "Malware payload (PureCrypter)", "value": "57d881fa5b15b62d098846d428328a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882360, "uuid": "2ac810c1-ec27-4bda-b32e-b97231acc6b8", "comment": "Malware payload (PureCrypter)", "value": "af37a266004a55d8fcfafffd7b631c085ac7f483a692456f157b4df2f3ad20a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882360, "uuid": "f4efe75f-b424-4b9f-9357-d0a83b828aad", "comment": "Malware payload (PureCrypter)", "value": "0ad25504e6b4b10dd1c2a75d1d36804e24e9a2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882360, "uuid": "9b8af369-2b9f-4f8f-9ca6-6cca89b28a19", "comment": "Malware payload (PureCrypter)", "value": "d52c93c383407b4657a355540c0775d35b1c338009bb240e4edc214191b5e083e254bf2cf3ca30ecb8de4286b4942c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882360, "uuid": "96b70a84-487c-4ea4-aea1-d70575ad06b2", "value": "T122D5BF2522AC91C9D17AD03DC9864A9BE7B57C428334D7CB05A0BDA92F336F56E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882360, "uuid": "8b47cdd2-afc6-4335-bbb6-a6caf53a0d36", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882360, "uuid": "f6989f76-57a8-4877-9400-71a689f52348", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSFzdY8la/VdPiE7pu/:Vv08Ro21Buk5/xgXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882360, "uuid": "e5cb7859-c322-45cd-bb10-df908e141b46", "value": 2751458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882360, "uuid": "e667fbfa-bf1a-42e1-8cc0-3ebeffd957da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882360, "uuid": "beeec800-36aa-4066-84e4-ee5600706096", "value": "57d881fa5b15b62d098846d428328a9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848913cc-a7ae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675860350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860350, "uuid": "53116e92-bdd3-44ed-91cd-be9128b7d8c5", "comment": "Malware payload", "value": "59515ee17bcfd81bebbd3a7e3b9ff0e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860350, "uuid": "ba468376-0dd1-4fbd-a71c-7f1749572bbb", "comment": "Malware payload", "value": "af853bbfed0c1f27eb6ce669852cd6b9e9321b9566f92d59ae06fc2a6fc3ce29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860350, "uuid": "bea5ebce-8016-4d07-9a86-0058387ef778", "comment": "Malware payload", "value": "b7a299cd23827886d145f751c848939cd2a1cf9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675860350, "uuid": "b72e9c38-54db-4e0e-8aac-6bb81064d5a2", "comment": "Malware payload", "value": "091d192afa6c7aec349a1250f1bf4087c63d7423f31ffe5fbfa46839832b036fe025c6d95b02a40e64f271ec2fad5eee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860350, "uuid": "39574025-629b-4559-a62e-5fece44a4a47", "value": "T1B8E623B35481BDC7E27093B66C2781858C29F5B28F062675F42F5BE180A698DCFF5B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860350, "uuid": "cda54889-2da9-4f19-b344-b46cf79e9481", "value": "f4fc9084548cd4b9d921befccf1ffb4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860350, "uuid": "3f965a79-dae1-4a16-90d7-42e1d4cc6cbb", "value": "393216:dwntBUa6Ax2eS/XXVgRq+Eu0S9gBJtOA6oBdvgpR/ge:cn6Ax2D/XXqRmuteJ/iRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675860350, "uuid": "fdbe065e-66d6-4250-8cc9-3cc35733e3d1", "value": 14664704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675860350, "uuid": "6444f0a9-b26d-4aeb-8a56-e230b222cc5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675860350, "uuid": "df4cd3f4-a0f0-4090-becb-9399c198788e", "value": "EWYXBITAGQ.aNg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db74ac26-a7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675880682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880682, "uuid": "297af0be-fa81-4216-a5cd-34c7fc8b36d3", "comment": "Malware payload (Guildma)", "value": "5de82837c444f8d33f5d031e28e5fd36", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880682, "uuid": "120bf09f-c3ab-4e69-b2a0-73dae1310287", "comment": "Malware payload (Guildma)", "value": "afec4cf50f1d5134619b192cf91bfe3186c1d2821780c3456718f12ecf7e2090", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880682, "uuid": "61dbb0fb-93fd-4bb2-807d-f3fe260220ca", "comment": "Malware payload (Guildma)", "value": "88b3961c37e53ef43d445adcd0c0e498b07dd819", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880682, "uuid": "438dbf9e-761b-4e67-b2d5-ccf01e2d5840", "comment": "Malware payload (Guildma)", "value": "34a20235d029d1cc0a5b47fe4368385032084ae66e336272bd924433eb677ffbe1f6ff533e49c890e0b7218f0073dce6", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880682, "uuid": "4c92ba67-7f15-4ed6-a171-be8e056cc1b5", "value": "T18422ECD5660BC0C56469CB314D6B1409F6C46072EE109CB076FFED76BA74A12F3A3A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880682, "uuid": "cddee587-6648-45ab-948d-c2b7ec13cce2", "value": "96:ICO6EtMGBIEMmLSTsmTOxjQvi7WnSG8lPWrGb75E5DGZHQs/6srOnk3RgWTNH:IttDIXm0sm+U5+lOU7IGSC6sh3RgWT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880682, "uuid": "cb1c7e43-f796-431d-a243-c7ca70af3cbb", "value": 10626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880682, "uuid": "45d47ec7-6bc2-46c0-922a-f72b82451072", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880682, "uuid": "faf1d2ce-cf39-4d39-a6f7-ec6bdd3a8b83", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be02402d-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675885358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885358, "uuid": "d4101fc6-aca3-4de5-bfdd-618e1202c632", "comment": "Malware payload (Loki)", "value": "195897114628c863f372b3d6ce3e7cd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885358, "uuid": "7d4d0adc-75e5-4337-90e3-92dc1f268523", "comment": "Malware payload (Loki)", "value": "afffa10e1f2d23ac3177cc69a490ddcec88d2a3df3cd2b037a4e6e0ec0e51285", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885358, "uuid": "73d626b2-bc5e-41cf-8bac-edcfaf5d017b", "comment": "Malware payload (Loki)", "value": "9bf0beae1218d717447e5d69f5bb29deece86ae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885358, "uuid": "70329624-2660-42d7-9cc8-81bb6d6eb75e", "comment": "Malware payload (Loki)", "value": "cffca43c21642adb462ec4cb2c731089781c837fd6519ee8ada059ea74b56c0899c6fb961ed8b47cd26a2c0cda422c6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885358, "uuid": "fa94279b-c9de-4c44-a6d3-2faad6a42628", "value": "T17A1512146144DA64C56806BEC8B1DAF027B52EB9ED60EED73EC2BCCE7E75B6120406C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885358, "uuid": "d0be6ec2-4859-4bc1-a8b9-7feded01963d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885358, "uuid": "2e1a0be7-d766-4fd0-b2b5-b2763785efb5", "value": "12288:Te2iNZrgzTTGhgzTbAp5CiLo20qLrMVYCb5LEkOFl3V8WhXjLP4M/Qe0iI0f:C1bgzPGhgzfYtXyNlgjFDzLwMYej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885358, "uuid": "7b214323-babb-49f0-b326-0302a25f1f50", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885358, "uuid": "e380a776-e681-4dbd-a543-41f043571c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885358, "uuid": "3696dafd-70e7-46c9-9b86-57303025c43c", "value": "195897114628c863f372b3d6ce3e7cd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23010bb2-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675882091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882091, "uuid": "66c4747a-2e00-4c3c-a389-1249f28184a0", "comment": "Malware payload (SnakeKeylogger)", "value": "9542575a0be3535f7281780448ade11c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882091, "uuid": "57ead544-e598-4f90-8c4e-0a9733cad9c2", "comment": "Malware payload (SnakeKeylogger)", "value": "b03dd474944f447c9c3aa056fb2043a8fb6b00b9fab926faf7c8edf7daa8a35d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882091, "uuid": "da6b4f6a-9bae-40c9-8228-426d43f6a93e", "comment": "Malware payload (SnakeKeylogger)", "value": "6a01a07bbae90d233634c75eead9953448c867c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882091, "uuid": "75ef52a6-d280-4b32-96fb-f9e8f435f1aa", "comment": "Malware payload (SnakeKeylogger)", "value": "8ccb67f2cba22dad9e3004f74a4c8c3242bedb0e6af860ee0653de113e3d413e15f0c0030a80cc4ea5552a958caa2eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882091, "uuid": "04189bde-54a1-40b1-af0e-e7bc399ae5d9", "value": "T13815EF1263E4DF42D0A643BC59B2EBD01773A935D1A0EDD85DC12CCE0626BA0B957BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882091, "uuid": "68ccbe0d-326a-4976-abdc-1476958879a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882091, "uuid": "d338cb60-7dd7-444e-a628-0b7a0db330fe", "value": "12288:6AWlV/DfrpsN3RqNmOF/uZSJWUPEO8D0jn2uiP4M/Qe0iItWlV/:SlpDTpg3cmi/7JWUPEO+I2uiwMYevlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882091, "uuid": "4fd0ae91-fddc-47d5-9d2d-716034cdc142", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882091, "uuid": "b4f4aec1-5de5-409b-86e8-7d166dd87278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882091, "uuid": "37c4d311-ef7e-4ec5-9310-e2c4e08a4ee6", "value": "9542575a0be3535f7281780448ade11c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc6aa95-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675882002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882002, "uuid": "53182616-24b1-4a58-ae21-a1f7b1ecadca", "comment": "Malware payload (RedLineStealer)", "value": "dd4cb5245e8040d454e2a41e41b50baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882002, "uuid": "5a1ce45f-ddf3-4de9-b7b2-553fe14226c3", "comment": "Malware payload (RedLineStealer)", "value": "b0634d85ec75045ffc2b38e22e4724a2cdcc8418bb604bab635f866d7c8d1cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882002, "uuid": "4ea306b4-e3e2-4921-aa90-747bfb5e8c7d", "comment": "Malware payload (RedLineStealer)", "value": "7a69de994120ec59adf5184a0ebeff206139a449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882002, "uuid": "5cbe9ca9-8130-4dfb-9085-2354f5786048", "comment": "Malware payload (RedLineStealer)", "value": "762b1822777a27a072cd5a2a0b9806c721d67f824c4a62a41a197bd453e8158143e923c516e65c427d50a785d94ad063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882002, "uuid": "3fbdc06c-965d-40c6-a07b-c6059575748f", "value": "T1D4946C53A3D17C48DB26CB33DE1EC6E8F61DB990EE4A776D3218AA5F18B0172C563211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882002, "uuid": "8068ce51-1735-4c34-9878-dd5db3bd2571", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882002, "uuid": "97c05d42-5d57-4641-b2a2-0fb7ee19090a", "value": "3072:Ew9qBGdvwXR5bMCv5tPYqxQHWxZtDjGVBD322unATSCYj2D0J/Ou2eOV32WByUAU:Ewq4UR7YHH+gGVnS3v0wu25GWUjsTIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882002, "uuid": "1d657ac4-32e8-4068-ba36-82675f21e79d", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882002, "uuid": "27dcee7e-24ce-4877-91e8-7c4f6003dc11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882002, "uuid": "f5cc8155-a716-45ee-89f9-10ae1ff69478", "value": "dd4cb5245e8040d454e2a41e41b50baa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0bc42-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885636, "uuid": "c8128a32-9987-467b-a03c-7d71ebfea2e5", "comment": "Malware payload", "value": "3313519e4ce1b634a12185d5bf8b7796", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885636, "uuid": "df381232-c45a-4b70-939a-2d1ce9bb901a", "comment": "Malware payload", "value": "b1744a278180e4f7763e16bcf70100c9cc157952144ee3e6618b6e2e6b7dfa30", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885636, "uuid": "5afa62c7-d428-4dce-a9c2-2c4bca8065ee", "comment": "Malware payload", "value": "1d53d3ce5b2bc3e0965c01a51d8f586bbaec9234", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885636, "uuid": "c418c7a9-1f29-4980-9677-7ad9c9647ec6", "comment": "Malware payload", "value": "9a9fe44bb9de4a7c8b0a3b66ada3b0009908aa2e865cb52196893e33a3638cb88b1332626b94d31a5ee4f7e1f797e464", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885636, "uuid": "29255edd-cbfe-4176-b47b-0437cfa47382", "value": "T1CF143171E1578C6CD008933D60E65A6257609C191BE2A70F11BCBF5BEFF24606ACEB72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885636, "uuid": "3e5dfada-dd75-412d-8d9a-618e2413effd", "value": "6144:QxEtjPOtioVjDGUU1qfDlavx+c/UgLYLD2leReYU:iR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885636, "uuid": "1d45cae5-0cee-402a-9718-8525ffa9ffae", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885636, "uuid": "2f5e64d4-034b-4558-997d-f156cc66b04a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885636, "uuid": "960e800b-c518-46ef-995e-59b9b40440d0", "value": "b1744a278180e4f7763e16bcf70100c9cc157952144ee3e6618b6e2e6b7dfa30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b6f7c8-a7ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675858975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858975, "uuid": "1ae008dc-5b7e-4a9f-a1e1-57b86dad856a", "comment": "Malware payload (Mirai)", "value": "8f9ce8b6be7ec8188055e4961d214663", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858975, "uuid": "0d9f2f80-89ce-4bfa-915c-0e15651875bf", "comment": "Malware payload (Mirai)", "value": "b2083d04c7b8d8e8cc44b5ce983575bbc0bc47b1e71dcfeb8bc7790be784735f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858975, "uuid": "f596a227-8f03-4fb8-99bb-5a1a4f71b566", "comment": "Malware payload (Mirai)", "value": "d3c87f750d7da548d6484047e8088db021e1471d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858975, "uuid": "a576ae04-2ae9-49f5-b65a-c0a6880cd80d", "comment": "Malware payload (Mirai)", "value": "2590fc07c40dd8fee3d445a721dc6ca21a45c0aaee1965e0a577ac750281362b3b3c97b3fda53bd227b784010aca50ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858975, "uuid": "d184b21d-fdf0-40bd-a033-54f608385aef", "value": "T1B5D2E1F4EE78E79AE0C9773D4E5EDC4B309C6CB61FBE44054A520E266439A61A1E4DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858975, "uuid": "297868b4-065f-4526-b265-080ec7bf8eef", "value": "768:+N8fWlfoQmQAXV3EmQciiRcfSZd8H0GuOIzOhsPMqT:uMNXFl3zNl6uBzGMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858975, "uuid": "655675e5-bfee-45c0-8f50-f249c159eb4c", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858975, "uuid": "2a939e79-23f8-482f-8a04-8940632a6873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858975, "uuid": "bb3fa2f9-7b73-44ed-b832-81c8a9b80482", "value": "8f9ce8b6be7ec8188055e4961d214663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e8be88-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881457, "uuid": "bf1aab00-dc68-423a-820f-e8a59a822d9e", "comment": "Malware payload", "value": "115c30afbf3a6b6f7fd43b25a0d286d5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881457, "uuid": "bd7f7ec8-f2f1-4a27-ac17-dc73e14fa671", "comment": "Malware payload", "value": "b25ada06ea01e722ac2b932bac8640c84355b29c8c298799e0ee797d18937524", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881457, "uuid": "72f337cb-fdeb-4755-bc79-dcd12b0cc1ae", "comment": "Malware payload", "value": "20446917c9f8ad50c1ad4432ea17682fe55ba7f4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881457, "uuid": "bddb869e-6cf0-4894-819a-9e29fe532638", "comment": "Malware payload", "value": "abc9d15379dd1eb72dfb9bb68bbf922d5517aab57c9c349437f70271e841dbf72571014741bf5842a06b1d13ce9e278b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881457, "uuid": "eec901c4-ee0b-438c-a959-a9dd09f4ba82", "value": "T119857C21B2C7C532D56D0276E428FE5E153DBEB30B3101E7B7E8396E59B08C1627AB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881457, "uuid": "485d6fba-afdf-4472-ab0c-5bf7b46d11a6", "value": "49152:9TiU8r6I5WCmR+JJke7awlK2FV9fXlVeIf:to6Le7a6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881457, "uuid": "cb070d8b-c775-444a-aeb9-2ca6dd562a83", "value": 1720832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881457, "uuid": "ace1b116-2000-4654-9878-af9a538f7553", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881457, "uuid": "a73913fd-ab4f-4e5a-bbf6-c2bec60a7d82", "value": "NotaFiscal.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf2db75-a746-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675815831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815831, "uuid": "be5be798-cf52-4435-9d6c-74f57e52867a", "comment": "Malware payload", "value": "a0b9465a5cb1990b6f66a86234275290", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815831, "uuid": "682262d3-094c-4adf-bbe7-b474cbb85b60", "comment": "Malware payload", "value": "b293d21566f6766b82194e8beb6e555230d35adf8b2c20a3d756405ada04e0b2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815831, "uuid": "3bc7dd84-3a25-4d6e-97a6-4737efa98e80", "comment": "Malware payload", "value": "27a64743245bf6eb6d0687f730249a1c7391471e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675815831, "uuid": "a94cf134-307d-4a5c-9e67-1f220023f729", "comment": "Malware payload", "value": "8514ced05b3df41455705ede441fdd1473779b3b17fdeae22571a90a082bc432f32c815b2cd794c1e2f6140cb9006536", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815831, "uuid": "cd54e3d1-389f-4851-bf9e-fc6346e21076", "value": "T103B0125B058EC563ED02E4CB5B501D47F8D2C776270A168C031D468C00C9C2FF00A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815831, "uuid": "a81af976-36cf-4a13-9296-40747be9d71a", "value": "3:PT13wOpLyxr3FcuIaHF5oQWZpKF2IAFtYn:5AsMr3K3aHpWZkXAFtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675815831, "uuid": "4000e7b9-d223-4e6c-8aaf-5af10298bb50", "value": 111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675815831, "uuid": "a7b709ea-aee2-4fb8-be37-c641edb3ca1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675815831, "uuid": "147bc4d0-370b-4172-a1c5-38862a908f26", "value": "install.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9308cda-a781-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675841192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841192, "uuid": "ac80d8a8-74c9-4a39-89a0-b226ca4e5d41", "comment": "Malware payload (Amadey)", "value": "d91a7e27e0e9aa436332d18f21d3250e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841192, "uuid": "40a364b3-3d14-439f-b8af-cf50240c9718", "comment": "Malware payload (Amadey)", "value": "b2ac1168814e1a20fdcdea21f954597d77a4f5352933836f691af80f28ddbc32", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841192, "uuid": "0b955e23-d200-4b6e-b501-522de0096efd", "comment": "Malware payload (Amadey)", "value": "fdb150c4a935f642524c187799211da2c4600b91", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675841192, "uuid": "3dc8aa17-80ee-4101-b7e6-677a7af8f4fc", "comment": "Malware payload (Amadey)", "value": "d982bcba8101e248c1d4c78951d5c003ad48bf1ac8b4ffb9891f465b843380672bd93d3320fb575ac7d264ff640c6a9c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841192, "uuid": "197ef790-3008-405d-814b-f71e434a0872", "value": "T1FFC40257E7E85032D4B61B3029F712C30A767D619B3D829B374A6DAE19731A0B23137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841192, "uuid": "b0013779-6a04-49ca-b5c8-57b00b944397", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841192, "uuid": "de34389a-844e-488d-962d-9d21aad45be7", "value": "12288:zMrmy90pOFtPIV5vRADNDCq2/mvCGfLeP/Mwz3xZoh9CP28K2:tyztP8Rm2/cCGCPzeUP28T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675841192, "uuid": "9d625e90-25e1-4ad1-bba7-277160ef59f6", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675841192, "uuid": "22d9664c-0fa7-4218-a37e-8592c6022001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675841192, "uuid": "fabef878-06bc-44ae-b57c-c0a7b2398c8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9faddb2-a7c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (FormBook)", "timestamp": 1675869540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869540, "uuid": "6bb68717-61fa-4821-9f0a-93f55a369187", "comment": "Malware payload (FormBook)", "value": "e1821349a19731861d7784713e3295b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869540, "uuid": "f6772c31-7cfa-4cca-b0c0-7a2c7b25d577", "comment": "Malware payload (FormBook)", "value": "b2b22793cf3b49d769cb7f05175d9ca3b9201faa719ccc8a1c000abafce87386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869540, "uuid": "5ffb436f-4212-42a8-bf03-9f7765bdd964", "comment": "Malware payload (FormBook)", "value": "41fba0db8b9ce4b0aed53dad68f364d8720b6810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869540, "uuid": "a038b97c-da50-4675-b5b0-7f1dc9de7ecb", "comment": "Malware payload (FormBook)", "value": "fdfc07c32939f44c380037f3496f97e4a76a2a658b8dc90c2eb547d481a8d6014672f22bcb62ebf78c7feb276095cb80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869540, "uuid": "bc1488a7-047a-4742-b10e-9c54a5a7a3cd", "value": "T18C541248B6C0C457FD6309F3DD3A85BA77A29E10C4A9560F93607E5EB476602CD1F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869540, "uuid": "04bc5d66-01c0-418b-925b-0fa768843820", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869540, "uuid": "81667fe9-41f9-41e4-b7f3-b54f85769cf6", "value": "6144:nYa6veNblBC1FRriU2lO/zNKCAmTDeOzyedd+z5JI9tjyjN:nYsNJIRk4KiVdc5anE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869540, "uuid": "3977a7ba-a963-4f65-91b9-69e72bd2de0e", "value": 301694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869540, "uuid": "741b8bea-765c-4123-a875-609983367bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869540, "uuid": "cb1f40de-a45d-4b41-8fbb-3cf964b0b3af", "value": "HXM030055001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db90bca-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675885277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885277, "uuid": "faa97c4d-1021-44ef-8136-0f7902e34d54", "comment": "Malware payload (Mirai)", "value": "febb5c6c7c5161a1947d1e205a700eae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885277, "uuid": "9d583142-d767-4661-a9ad-4c71085f86ca", "comment": "Malware payload (Mirai)", "value": "b2cdc9a511b4b405e755414246922ecae7c1cf53d136fdbceeb93e18a16a3feb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885277, "uuid": "ab36f762-c577-4141-a20c-c4b623aadc65", "comment": "Malware payload (Mirai)", "value": "fd7b81549bf69103e991c7c1ec4d23fc91309704", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885277, "uuid": "465a9566-27c6-4630-8515-d8309beda75c", "comment": "Malware payload (Mirai)", "value": "2ebcb75c166d49114f628abb85246eb4ef685b8e5c8c187d42fc3b4de666c03dc5fd6b3b206e9f05b5813e117a2a2dc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885277, "uuid": "e2819727-d264-42f0-a198-adad78f2be04", "value": "T146C34C46EB408A03C4D51775BADF424A3323E755E3DB33069918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885277, "uuid": "ae9bce66-0c6a-421f-90bb-a1a0cec09659", "value": "3072:7Pe4R72PFYKav6ucJAs1R1Oo+0+BM/9bJz:7P/72PFYzv6ucJA0RJ+0sM/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885277, "uuid": "3012c71b-2172-45c9-b0a0-32bc25bcfba9", "value": 125778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885277, "uuid": "ac8697f4-d3ab-4100-ab46-409b1966fee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885277, "uuid": "47690abc-fd5d-4dcd-8591-fe7e3dd95f99", "value": "febb5c6c7c5161a1947d1e205a700eae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4226f866-a77e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675839623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839623, "uuid": "6eea7d7b-08bb-48f8-96f6-25c47dc15197", "comment": "Malware payload (Loki)", "value": "00c9e269db13568cc703bd4273787201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839623, "uuid": "472ef77e-6380-4e1b-aca8-af55b3a41779", "comment": "Malware payload (Loki)", "value": "b2f5c7f17e78a48a2a0d31138e54995eb71e55410ef7207d570c344c258ef336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839623, "uuid": "42c57572-bcdb-4fe2-be16-50b228278b7a", "comment": "Malware payload (Loki)", "value": "162915bdefde5a9a317d5d68eb92f0be67cdf356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839623, "uuid": "14345ab2-0aac-4c5e-bf90-238e21ac1dde", "comment": "Malware payload (Loki)", "value": "b8b6d37c91d7fab9a577e15a0a6c2c13a42230a0c3f3a9ca71d5ccbd14dac99147c016b71721c144b296df4cfecd03ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839623, "uuid": "5d0e6caa-c161-4792-95ba-23725bda6937", "value": "T12475DD749CB70585F00B89B3D9B9FFA8B27639E38AD92963071C72240E37D672B4E055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839623, "uuid": "dc6f06ba-2534-4ebb-8b45-4d8c67bee7ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839623, "uuid": "8ce0c938-9e82-4077-9c70-e101cdf6dc1e", "value": "12288:EmIbRtHUB7lceAvWDlwFnJCSVDKhEzkpgOim0TC+j2oHa5CiDWKGmGYqITrpmc:cy0Tv6osFqITrpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675839623, "uuid": "22df1a8f-d1e8-45f0-85ad-5842d7049737", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675839623, "uuid": "83d0ec63-59b7-4233-b1d6-0e0b71d1b7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839623, "uuid": "79442eca-cd84-47fc-829a-41a4e6186908", "value": "Payment Confirmation Slip Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4448a932-a801-11ed-88f6-42010a9c006e", "comment": "Malware payload (Emotet)", "timestamp": 1675895891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895891, "uuid": "3c5ce9c3-6565-4f9d-a5ec-6c3543a2b529", "comment": "Malware payload (Emotet)", "value": "6b500ad29c39f72cd77c150a47df64ea", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895891, "uuid": "1efe2203-e2e6-4032-abd9-6bdfd81a7143", "comment": "Malware payload (Emotet)", "value": "b375e37ee678d8fa056e06cfeccbe1077d517365a46981a811adb637ba5c838c", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895891, "uuid": "267ecbd1-08f3-41d9-a0d5-51456099551f", "comment": "Malware payload (Emotet)", "value": "d16253151f6e59942e45b105efbc0f2e97984411", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895891, "uuid": "706e41cb-d530-454d-aa35-8b99fe8f3b90", "comment": "Malware payload (Emotet)", "value": "80aa76bece4c0cafdfb772c442c782d32bb3b0ad55592bd0f6e1e258a6dd043244e908f8dea95df4fe801776560a7a6b", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895891, "uuid": "92532541-b238-4be3-a78a-f9c1e8b66e3f", "value": "T15BF49F0311E26DB9CA4183346A8BE332B6317D980113FE5F66A5D5322FDA7E11F3EA54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895891, "uuid": "f3a7003b-e286-47e9-964e-3d89cc804613", "value": "e88d922e701221cb88fa0287a0d4ccbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895891, "uuid": "73386277-a354-4fb2-88f9-705751f13d9b", "value": "12288:JTccQYkTOmw29akBlIwJrdNbynC8lfTgjy5c0AsL/UWkr2dFrJDKThRCB3zkU86y:JTccQvw29akHyZpgy207zNRdRJDKTHC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675895891, "uuid": "9855b80f-0652-48b0-b7cc-354d118240f1", "value": 775917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675895891, "uuid": "18bcc442-d81d-4c02-8230-c5901d60e6bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895891, "uuid": "24eaba4a-2158-4782-a7e1-bcc2ceda208a", "value": "si1yaretouu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed545279-a74d-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675818865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818865, "uuid": "e1f0c8eb-d7ad-42d8-9452-4291a2263566", "comment": "Malware payload (LaplasClipper)", "value": "be30ec7ab19bfedb892fde3afb577603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818865, "uuid": "9e881d18-ba56-42d4-8d7b-9a896e152613", "comment": "Malware payload (LaplasClipper)", "value": "b398065ab48ca2a1900c2192c2883330b414f5f74fa04ecf2b6ae99698b8e63d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818865, "uuid": "5bcaac6d-1949-4801-8554-933505af9bd1", "comment": "Malware payload (LaplasClipper)", "value": "e52f9dea4400166c4f489a5626df0008a6eed818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818865, "uuid": "49e8de39-5ee3-46c5-a83c-959dd0e3ebad", "comment": "Malware payload (LaplasClipper)", "value": "91356aa3ff09fb8ce1e0f34bfee292367762937fbc6c8d6dfa25746d8eb5f8e857fe090274d53cce8e2669287398c81b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818865, "uuid": "e584f345-6926-4a3d-9a6e-5101bb9d0a57", "value": "T12F85233176C8D077C4B761BD4965E6946656B42028F9CE0F3BA007BA2FB42C23D2E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818865, "uuid": "26de94c0-7e63-44aa-b417-3e95bb4a1054", "value": "3de943fcc7aac4f92f0aa259611cea93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818865, "uuid": "e6d76d79-ecb4-420e-bf52-71515bd79149", "value": "49152:FuXEnBSze5817TMBYpenuq5oncZS6K6h8DCM:MEnIwicZS7TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675818865, "uuid": "31b234fd-7dd4-4569-97f6-d74a4479385e", "value": 1869824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675818865, "uuid": "8d1c59d7-d9f8-49f9-9819-e0132fee14a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818865, "uuid": "119d1561-a734-4ebb-a8dc-7632a904fad4", "value": "be30ec7ab19bfedb892fde3afb577603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcfd72f-a798-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675850836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850836, "uuid": "f0ab543b-759b-4ec7-9f19-cc8ea9bc217c", "comment": "Malware payload (RedLineStealer)", "value": "0d70a8815d4ce3373db5c3d7a48b2807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850836, "uuid": "daefb648-56ba-472f-a0d9-4d6b2752d9e4", "comment": "Malware payload (RedLineStealer)", "value": "b3b431849df2ac0439b954549a433cdc7f97421f9caf29da6f682542f134893e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850836, "uuid": "46b8d8d8-1095-40d3-90a7-522564221646", "comment": "Malware payload (RedLineStealer)", "value": "c845f12287996ecb22824856aceaeada5365139f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675850836, "uuid": "67999165-955e-43aa-a247-34f0f6455a03", "comment": "Malware payload (RedLineStealer)", "value": "854aedccd2827e4abab2812b2c50a62c440ca2ec7f9be73fb6c5952e1fd7d2fb84ef88c1986b43fa8ff510bf40309171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850836, "uuid": "aabd4178-1dfe-4c49-b359-6f459cd7ec94", "value": "T13A948D53A2D07C48E9258B73EE1FC6E8F60DF550FE4A37693218AA5F18B1172C673612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850836, "uuid": "d410551d-8e73-4d0a-90cb-f2f4e47f27b8", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850836, "uuid": "97019f06-315e-45e8-a88f-9abb410d6516", "value": "6144:G3Q3UXt/suzeUsneFWX1LSgbvOiFi+BpWUjC7CaV+I2:GA3esuzpse4F+QvNFlBpx07V+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675850836, "uuid": "0b1bf450-3c51-46f7-94f3-6de1dafd68b7", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675850836, "uuid": "d4fa0271-877b-4049-a86e-c3e7f4b080c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675850836, "uuid": "9806b620-59f8-4e3c-90d7-156cf715d69d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2d0896-a7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675889842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889842, "uuid": "35c09d3e-a901-440d-9017-f8bbd4807ca9", "comment": "Malware payload", "value": "b73ad8a54a0bcdf749dbcb40919b82ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889842, "uuid": "a4ab8897-b693-484a-8b3c-f71a49197055", "comment": "Malware payload", "value": "b3d2ebb39b5731a2cc8e0ee08b71bd59d6ebbbe551684fa4ec17e2aba7e8c237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889842, "uuid": "cdda5fa9-bd74-45db-99f2-ef9405c906d5", "comment": "Malware payload", "value": "193cbffa49b9ae218e9eff022432858af35156a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675889842, "uuid": "c84cdd10-445a-479e-adf3-d66cad78d281", "comment": "Malware payload", "value": "53c4a5c37566b67fe6e661532a1482bca2afdca3e4f40e1b10f8bde593f3bcf6df49e068e0e7526e0b6abd97c5aab957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889842, "uuid": "7251cd55-0827-456f-a7b7-bca26a4825ff", "value": "T16B641903D2E27C81F9668B76DE1FFBE8765DF5608E4AB7653218DA2B14F0172C263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889842, "uuid": "57219ef0-8727-4379-998b-ac6dd715c807", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889842, "uuid": "cb80b9ad-4233-43f8-978c-dc5a8a80aba6", "value": "3072:9PgXuJ7n5RFthoh4EZUz08XYy+SNphmj45AinsWQDiuLp6I0SgvG:9sgdtih44s75mcfsLiqz0vvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675889842, "uuid": "1fe976e4-9450-4038-8a3a-5eb32905e27b", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675889842, "uuid": "78bb995f-cd0f-4262-ac28-bd4c5324c423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675889842, "uuid": "31d032ea-c1b4-48ec-874d-3063f8697ef9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959ee28d-a7f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675890014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890014, "uuid": "3a46847d-63ad-469c-bad1-60c0edb17add", "comment": "Malware payload", "value": "0f6d4f195ee5ce2d3017b2492f6c3d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890014, "uuid": "0702879f-55a5-4ed8-8be2-5972e0175af6", "comment": "Malware payload", "value": "b5232ecbfb0cc0147ffdd61fdfa70a821c85190bf978321fe52f0e66069a7e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890014, "uuid": "13a5d55d-8f14-41b6-b775-c07b7a42bf2d", "comment": "Malware payload", "value": "29e73d2fb0813562ec73d499a9cc61c1b7b4f56a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675890014, "uuid": "9bd20cc5-c9ac-4d3c-98c8-6d0e79b69b64", "comment": "Malware payload", "value": "dcd36687264b29964d4b619647f2a95130f7886aaaad031bb4460595bbd6ed7efe1f6cf5e3bea0f345d15c8c55007a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890014, "uuid": "a0bcc601-d1e3-4429-a298-da485313e004", "value": "T1B4642903D2E27C85F9268B769E1FFBE8764DF6609E4AB7653218DA2B14F0172C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890014, "uuid": "d621122f-57fe-43ab-99a4-ee97704e56af", "value": "bf429ce1bef7a73c16e22bdf4abc3568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890014, "uuid": "8e1b8f55-37d5-4a5e-a36c-0b0f2b073d83", "value": "3072:FPgJonTU5RFIepd2eVzByi9Zq2ahRPVPy9KsWQDiuLpIW2+xWgv:FKwCIep82XfOxGLiqn9Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675890014, "uuid": "59fc47ef-421c-4ff6-a5f0-2c0800aa24d9", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675890014, "uuid": "a730e2a1-47bb-4f17-aaed-2297816f00f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675890014, "uuid": "0cad8f2e-fd67-4f73-9314-7cf657e69eb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e216dfe-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675882110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882110, "uuid": "7b19d979-6214-4876-89bc-70de9ded4705", "comment": "Malware payload (Smoke Loader)", "value": "7bf9bc7b539ef9b9b16e4617075a4093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882110, "uuid": "7a4c1abf-9f96-4190-b671-5ba13f15f19a", "comment": "Malware payload (Smoke Loader)", "value": "b5d3b92d36198035df9370027e3e1e269f9757c4006a1b4eda2dd5575caa4d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882110, "uuid": "010fe356-d2b2-49d7-8dd8-790ab4ba3275", "comment": "Malware payload (Smoke Loader)", "value": "50a52ca7cb848e121b7bb712709d166d00db72df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882110, "uuid": "81df1719-f258-4c23-8a4f-f51b338a370d", "comment": "Malware payload (Smoke Loader)", "value": "3c10c41d0c5976664828d1a7e5768fd9468a118b31f6feb14137b01de0ad5a98c0ff3a8ef03a71544ffbb071d8f19b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882110, "uuid": "31dcbbf8-c2f8-4756-ad6b-1cd3c2d05db4", "value": "T121B2DC0263A8D6B9FC133E749CA717714BBAADCA88329FAF8C5079DABC78341C515710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882110, "uuid": "4a7bcc02-f626-4afd-ab31-6f46a08bd591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882110, "uuid": "867317ef-7eb3-45e8-ba5c-5b8f2788cd2c", "value": "96:i8p3jFpU/a5me4xn0bGkCNiRB4e3T3eb1MnMMKXTMMVzNt:iiFpMUm/n6rCFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882110, "uuid": "dec9f301-9b64-4d34-a32e-ed814401b8e5", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882110, "uuid": "5462f628-f4f7-438d-833a-578611991d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882110, "uuid": "5332851f-84fe-471f-af3e-11a2a7782c0a", "value": "7bf9bc7b539ef9b9b16e4617075a4093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d744b7-a79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1675851650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851650, "uuid": "743c96ef-2125-45e3-bd60-18552ef2e2ad", "comment": "Malware payload (EternityStealer)", "value": "899cc27a165571b54c8a1848777b0ec8", "object_relation": "md5", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851650, "uuid": "899f688c-d288-4f34-bad3-ba63da863438", "comment": "Malware payload (EternityStealer)", "value": "b64510de274a0c1b0df1f1cbfd2082bd56eb87c85e8e5db88ab55ac41a1805d2", "object_relation": "sha256", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851650, "uuid": "b789987b-b4f3-4585-8147-07c5cf551bc5", "comment": "Malware payload (EternityStealer)", "value": "a3e7396acdad237833a2e7502e072b14fd338a12", "object_relation": "sha1", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851650, "uuid": "ace7de95-6cfc-4dd7-836c-667f0e2729be", "comment": "Malware payload (EternityStealer)", "value": "4d395396e68b293e04b5eead3accceecf3e5d0249ba99570a9e1d6ff14f041b18129c2ae23d66c7d580aa373bcfa2d6b", "object_relation": "sha3-384", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851650, "uuid": "50c6c271-3279-4642-a9c6-3646659d75c1", "value": "T10145C7B313636DDFDA360F38E1141A504CFABCAB726D82A87BC519D149E1058AEF4DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851650, "uuid": "739e45d0-b1ee-4534-b652-b0d75f623de6", "value": "6144:qF6Fv7Z2YncQOPd6sb38ZCpzCC5vrBEtRqG22BgA7EDfXDcmW7EFUB:qFSncQMb8MwoNEtgG22BgA4bzcmOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675851650, "uuid": "2e2257af-fb5e-40cc-89d0-70d9d188c8d2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675851650, "uuid": "5168dcba-598b-4cf8-8989-1e1805d513e5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851650, "uuid": "ee95b69b-8311-4056-8b86-74f054f1b495", "value": "INV-7141.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a5d6b1-a77a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675837881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837881, "uuid": "f68b673e-b956-419c-b4d7-74c6b42d8d90", "comment": "Malware payload (GCleaner)", "value": "c40df8f19c763b52e775629f30108877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837881, "uuid": "de3cac7c-9678-4e51-ba6b-a4972d228c05", "comment": "Malware payload (GCleaner)", "value": "b6b7a4b94933f1912d37088214d68255bf5f0aff669a22dbc9982cb8bdaa58b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837881, "uuid": "9a36b57b-ed81-46a8-bb2c-d5039ba4c931", "comment": "Malware payload (GCleaner)", "value": "d37476b408f17c7c7e45c9a42284db6bddd06897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837881, "uuid": "17da45c4-f8ce-4f80-8e7a-a34d1877ef33", "comment": "Malware payload (GCleaner)", "value": "dfa7a461fb77128220accc7ed5ea1eb95e19bad18d539b9508fef68f510fc050cb99f54340e43bd7f1b89388593fae55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837881, "uuid": "0862dab2-40c0-4496-8fe5-44783249e684", "value": "T1ADC5123C7145C46DD280FEB4893AE4E71CEA6EE3E9E4A02670DDBF3E517D2849A09147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837881, "uuid": "c418056a-498b-484a-bd1f-01068ca10e67", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837881, "uuid": "6af9a792-d7e2-4415-8623-4ee89b20e8f0", "value": "49152:rdHvH0EGrFoyhQjFgAY4/aYrrnqHv2irBGLihPFLtsLCgv2MR:JH8lvhlAliKrqFrBGLihPHsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675837881, "uuid": "a761e749-a8df-45d4-b16c-858549126758", "value": 2670909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675837881, "uuid": "dadd3948-9a7d-41d7-9bd6-f39107d5cd3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837881, "uuid": "02c8e8a2-81d6-470a-b84c-dadf1bf5004b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d017dd4a-a7d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675878086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878086, "uuid": "72bd553d-d4e3-4320-90a6-64f75ce70456", "comment": "Malware payload (Amadey)", "value": "bbf7133ec28897d990c7a88babfa1d37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878086, "uuid": "76476a85-7bd2-4b71-a4bf-de0e71826862", "comment": "Malware payload (Amadey)", "value": "b704a1dadbcbf5b601675f5a2422207bd2ad4f3ab1c1af8d8d9b93714b52c10a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878086, "uuid": "6e602e1e-4744-4c01-b04c-75fef52f4e77", "comment": "Malware payload (Amadey)", "value": "026607987f61822399ef7eb737a389d8cc200056", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675878086, "uuid": "79d6c16d-9b36-425a-ad23-2459e4680555", "comment": "Malware payload (Amadey)", "value": "9ecd0e97754f30b2fd200af77fb3211bb4c02411135afb3a5cd583fa27763aff377e80b198f91192ec3b1270c1f80ebe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878086, "uuid": "bb9f0504-c51f-4214-81d5-acacb38bf4d8", "value": "T1E0C41207E6ECC072E8B417B458F203C30A367E655B7407DB734F689A18B66A4B63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878086, "uuid": "5bf721e1-4dee-4d5f-a83b-6c4da665ec0a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878086, "uuid": "87f92be9-c307-4b6c-9586-591eb70ca15d", "value": "12288:FMriy90tlCmm20aVPYSFGppMlmTHl4t1WyxjaJeKkiJk+0v:/ySlCmm20aBYlM02HWveK/k+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675878086, "uuid": "58e72137-cd38-4099-9a0a-5e5a84026085", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675878086, "uuid": "486b6c7e-ca1f-499f-bc89-a025fd763da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675878086, "uuid": "d9bce3eb-cb1c-4cf2-95f8-2a78fa0f9860", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d230799f-a7aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675858763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858763, "uuid": "7b6f2a28-104f-4bb6-a6e4-cfb9d7c71d48", "comment": "Malware payload (AgentTesla)", "value": "964950ce240f5482724ee6dc4a2c1ad6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858763, "uuid": "02b6ae5a-0dfc-4879-8a07-0df38a33cf64", "comment": "Malware payload (AgentTesla)", "value": "b7c634bcc745337f95f7938965fc25ca5aea07634dd74e30cafae6a677a8ad09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858763, "uuid": "a07ede3e-b37b-4f68-9f73-b90ba7eb1f30", "comment": "Malware payload (AgentTesla)", "value": "e49bad052a3a5aceace9f5346bbaf3163f8628ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675858763, "uuid": "08f250b8-f9ce-4047-8a28-6224cd5e6fe8", "comment": "Malware payload (AgentTesla)", "value": "378d5201648284c9ced64f27dc3be4ecc4e36bfef371d9a038933fba61f76b1d44758aeb866c061da46563fc43a42fee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858763, "uuid": "e4486517-4103-4593-944a-106458544d0c", "value": "T163256D0139F6C863F08A0E7460283DCC3A3CE4479BDD419FF972A96493A6766F9D8D61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858763, "uuid": "dd4047c2-4a90-4d53-968e-b711230987ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858763, "uuid": "b8e88f5d-eb87-4fce-8e94-ea3b8debbd23", "value": "24576:lp14YGDkjwJsoGlWVq0lSb9ImgfFaUN3:lpmY5UsoGlEmI3N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675858763, "uuid": "ab50a847-84c5-41ac-8e87-a5214b7c8dff", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675858763, "uuid": "75ea581b-6d02-4cec-80b5-8d75dd54a468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675858763, "uuid": "24a9ecc2-c50c-48df-9b93-10101e00ad67", "value": "Original Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452bf75c-a7b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675863680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863680, "uuid": "d79375fc-3654-4221-9ce8-f1d28f455134", "comment": "Malware payload (Amadey)", "value": "99527e98b2a3f77fe637958aa26c34a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863680, "uuid": "21afad69-5ce9-4678-8431-07b8d0f7286b", "comment": "Malware payload (Amadey)", "value": "b806022522c96f5cc1972b53818613fc0c82225d7da48883db9dc1fd3a0b2551", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863680, "uuid": "ec389b8c-cf6a-4559-8f88-a820e49e2ef0", "comment": "Malware payload (Amadey)", "value": "8e2b0182bf8d548482fe561d50bbe6360a964395", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863680, "uuid": "1d071dfa-7166-407a-99ea-fe032db0950d", "comment": "Malware payload (Amadey)", "value": "eec8bfbfa5ac2c1153ca0cae813d3c814d827b291fbb91b1c0b4b35e8758e8eeaf285ad0e54c4dc1d5a2fc3bbc0d0b74", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863680, "uuid": "f4377ad3-872a-495f-81c8-545e87ce76e3", "value": "T108C40227FBE98462D4F46BB468F903C309367DA06A38879B374F69491C315B4A23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863680, "uuid": "2738bec1-3b80-409c-a200-8592a9bfd65c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863680, "uuid": "dfc5e048-e044-46e3-91f4-0b3744207821", "value": "12288:8MrGy90ExJvc64kEarSaT9mYMGMyMtooKICc:ayDxJvc6OdaT9mY/MHooKpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863680, "uuid": "4550da0d-4756-433c-a625-e3f560315b99", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863680, "uuid": "cc92021b-175f-4fcf-a0f7-24f45dbc77a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863680, "uuid": "b6c889ed-b8b9-48e0-bd58-17dceac0f826", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700a136c-a7ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675872342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872342, "uuid": "0b25bb3c-fbaa-4089-b229-d9055fd64319", "comment": "Malware payload (AgentTesla)", "value": "3dd1800e8ea0e7352e7badb99fd1e01a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872342, "uuid": "b67446db-6fdf-402e-985a-d59b99bb6806", "comment": "Malware payload (AgentTesla)", "value": "b8245f454be59d026b59c9e986dc83903966e4faa1ecf1e36f17037b8f0fa3a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872342, "uuid": "9d6c1540-9f7f-48e6-bf48-2f028009f8f0", "comment": "Malware payload (AgentTesla)", "value": "a19d0a9b689a36845f6133a495aa52e4488df7e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675872342, "uuid": "f7adc8fd-5a67-46c0-9304-4237ad5231ce", "comment": "Malware payload (AgentTesla)", "value": "cd8b9bda4cb2fee97a8290be4923daecf641b6d595f31df59909b06d0c9943894990e8e2c609df27f027b1b033428fbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872342, "uuid": "0efd017a-6aa9-44ac-8e4b-7b13a3fd0dde", "value": "T19874237E7DB3671240DDAEAD01AC528FAABD526B56F728110C0147B1FC44CC83679BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872342, "uuid": "8f7faa96-fa82-4387-8b92-87b1e6a909a4", "value": "6144:r2UZHoJSVyHZa0xvbsluSR8KMfUtUy2MidO9ptQf+04aQXhmlQVga+k:YhHvxtSKcOUicpWfL4aQXhOFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675872342, "uuid": "4987c7e9-95d1-4727-990f-7ab62459a405", "value": 366631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675872342, "uuid": "8eb74d1c-5206-44c8-97b0-3e7140c16998", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675872342, "uuid": "d2f0cb30-24d8-4b6b-9afe-34d51bf473ae", "value": "Docs.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a847609-a789-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675844335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844335, "uuid": "d02230f0-e9fc-4928-a60e-e7430214bfec", "comment": "Malware payload", "value": "b43025069ea5dddc05e84f318216c439", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844335, "uuid": "5a9f644b-8ad1-4b88-a199-9a1b36fa6c41", "comment": "Malware payload", "value": "b865a7c3afcd7b7518d1b00d713d03cb6dcab8f5f67a7c7e514241bcaaf7ffce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844335, "uuid": "3c4a794e-0025-4d57-964d-7566074c1666", "comment": "Malware payload", "value": "288a173bf1b04859efd4e7b285bfc531bf0b8bca", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675844335, "uuid": "0e1aeb27-dc6d-457c-8486-d523e4a8d8ef", "comment": "Malware payload", "value": "dd685f6d3524af48f52ea08eac8fb5d09eb1d849a3046db1c90c2cd5b582914d68c030ee60fa378fa63959e9c91409e7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844335, "uuid": "f5b0f216-344c-4889-925e-23f2bb716870", "value": "T135253351732BC5F42E0797A9C63369B13026D7CCF22BAF9A5BFC86F1B8055C8A565032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844335, "uuid": "14acb4b4-9bdb-4fff-8450-afc29b1e21bf", "value": "24576:EF5CpBPU3rqAIGiCQ5isMSO85FK9HWjd0F7oy:qMBmZIGTQAo5FVSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675844335, "uuid": "a1bf663a-7d58-42dc-8900-aad6cd846f06", "value": 963735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675844335, "uuid": "06828ea5-457c-481b-98c0-2479b95ce550", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675844335, "uuid": "e9c46102-e2c1-4a71-ac13-ab1dcf22e1a9", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02674a74-a7e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675881607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881607, "uuid": "f927ee37-81b3-4e20-aba5-ad0af47a9571", "comment": "Malware payload (GuLoader)", "value": "2c5add519c94bcfa2e7c1064ceb64736", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881607, "uuid": "13f78d16-5a7e-4d8a-a18a-40f6aaad1543", "comment": "Malware payload (GuLoader)", "value": "b916b37fcc5b1f5a77f6ff3c36904e9f20cdea77266acbe3566f3459d8c1f1d0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881607, "uuid": "0c58d265-c220-4b83-8853-e60e18c66c25", "comment": "Malware payload (GuLoader)", "value": "af99c8f0fb30a9a4fac437aa427ef44e41b535f9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881607, "uuid": "0e530cb3-85db-464d-856b-847cec75bb10", "comment": "Malware payload (GuLoader)", "value": "6228306658fc9879af4679dddcdb18e3a64dc373a95721b9fdeda738c6f464a4ab7fc448bc6ff12f8996957bc726dae2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881607, "uuid": "d44b24c8-801f-4efe-95b9-fc24d8ff1163", "value": "T12CC35954DF0D21090D0B27ABEC83BD64843D01B66026207ABDD9B39D166374EDA7EBE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881607, "uuid": "1bff0e78-24d6-4382-952c-c8075efe3dcf", "value": "3072:FrDq3Cj8LqEN9cy7jPLWCuHoq0lgmfaZXAR:1Dw/m09cyXYH/0lLQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881607, "uuid": "1b395951-a3c4-4a0a-8ac4-08793e306646", "value": 127726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881607, "uuid": "0555c3a4-f3e4-4a03-81d5-c1c4b060f05d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881607, "uuid": "abad1860-f80b-4a97-9d46-535c93d81a2d", "value": "justificante de transferencia.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a74bdcf-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675881325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881325, "uuid": "21cb6481-c537-4c8d-b6df-8db0e8352758", "comment": "Malware payload (RecordBreaker)", "value": "4979beaa139791aa9d265ddc00fff0c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881325, "uuid": "30df4c13-dd4a-45f4-9c52-42083b2f4c76", "comment": "Malware payload (RecordBreaker)", "value": "b94872e1a7599af25caa25013fc0054e5affda6cfaef65338aa344ca2b21b4db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881325, "uuid": "780c60c6-e298-46af-ac21-9cf9f59b4068", "comment": "Malware payload (RecordBreaker)", "value": "22301285c8a3e4fc0d8086f23265a2b5e7552544", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881325, "uuid": "75180779-7623-4a75-a460-0f4838cecd28", "comment": "Malware payload (RecordBreaker)", "value": "e5d55ea8ea41129c5d4181640fc8d66c29f2ded583e02fabc6eee548bb2108b78c9d25a0b819748791956f73f75287e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881325, "uuid": "310f3d6a-4ccb-4d40-9adc-b1eb88e4f70f", "value": "T168A5C0F491D6BC1FA31F9074C83757A39637AC20AA29EAB45752B102244C36CD1BFFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881325, "uuid": "e69831d4-f0c9-4c0c-a363-85e5f249f632", "value": "59d147a4d0fec921763249db448e8d8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881325, "uuid": "6758db26-2e31-4d89-8fd0-f4fa9081a343", "value": "24576:Or+mhOVsJou/n4JX293Q9vGvvrIs91cYZfT4xvIwDC4k+:BmhOsouP439v6Pc+fTYO4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881325, "uuid": "7cd3a6d1-f47d-4508-9ad1-a403d47d3d12", "value": 2103000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881325, "uuid": "c1e895aa-8e15-459a-9582-a20297fe23fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881325, "uuid": "77e27d1d-09bc-4fcf-a881-365bea45c623", "value": "B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a51849-a7d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675874974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874974, "uuid": "6c116aa2-b5bf-471f-b87c-e9a8b8e686d6", "comment": "Malware payload (Smoke Loader)", "value": "09dea05dcb186025318ff8a7ba05bafc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874974, "uuid": "21deb99d-f9ce-46c4-8a52-7568a308900d", "comment": "Malware payload (Smoke Loader)", "value": "b95ff65f77bf2ba3c5798631f03f0eb956c14e5273dcf6e84f38e7d99e2be7e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874974, "uuid": "3d40d7af-94e1-4769-a3a6-d53f42af7146", "comment": "Malware payload (Smoke Loader)", "value": "dd2b3c5412215e6f04ee5633d941ee36a2d01278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675874974, "uuid": "ccbb1936-7290-424c-807a-35ea9927c95b", "comment": "Malware payload (Smoke Loader)", "value": "9d193fa3c902ed3e4b3c55a18acc346f5f3bd6396f9ef0f5a0f3d99c9b3eb2161faa98e19772384d6621540ecad20f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874974, "uuid": "247c4b13-93c9-4024-a261-dd1f016202d3", "value": "T157641943D3E27C80F9668B769E1FFBE8765DF5608E4AB769321CDA2B14B0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874974, "uuid": "c9a33368-6879-416c-943d-54d44a5bc869", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874974, "uuid": "1811f3d8-f6f2-4de7-8b0c-e01b8b4619ea", "value": "3072:VPgcr2ddxR9gyneFlqXhk8zzkOdjb/oKeRS+SS8FEnVFJsWQDiuLpnM6uv:VLgrFnUlq3z460kSkscLiqM7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675874974, "uuid": "d6c45e7c-30a7-400c-bb34-2f56c456162a", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675874974, "uuid": "b6e726d4-9699-456b-87c1-9e6c4cff9c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675874974, "uuid": "ae68d064-384a-4b0a-942a-09dede3cde8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e26cfc-a7d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675876029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876029, "uuid": "160ef743-6b18-4974-b21f-f3300bdc0a0c", "comment": "Malware payload (Amadey)", "value": "7d3c29f4766df0689bb612ad74f838dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876029, "uuid": "94db0578-b820-46b3-bbc7-a9766e6f3d80", "comment": "Malware payload (Amadey)", "value": "ba9eb8f1cfb17b008221c0fd49055ddf9310fafa10ced8c32a5302b46c197e19", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876029, "uuid": "5d33735c-aee5-4c1b-83c3-52f63b03e2d3", "comment": "Malware payload (Amadey)", "value": "1e99020781bc735c403d84e4a5f34fcb9eb7c3ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675876029, "uuid": "88355c11-8cba-40a4-99d5-eb6407d14d79", "comment": "Malware payload (Amadey)", "value": "a57011371937b25231fb1afd0dcf6f75bc2385895ca9259e8600f2a467fa2472784d171fb74e1efa31aa943f1e150900", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876029, "uuid": "1a8964a5-e9e2-49ec-8c51-0fd5fffe544e", "value": "T1C3C40247BBE88022DCF067B118F612C30B357D611A79939B238E5E0E19726B476357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876029, "uuid": "1f51eb7d-cbb1-4b0f-bbc7-953d581dc95f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876029, "uuid": "935c95d6-0f0e-4fe0-b78e-d4699d806646", "value": "12288:nMr2y90My2OG3WeKRoKEBoq+fkKokhPUmd2O+y6DQ:ZyLOG3ZKRoEDkhkVd2O+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675876029, "uuid": "02847444-e178-4b55-8ee0-d043e390a8e5", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675876029, "uuid": "ed12d9bb-803b-4491-b3fe-2ed487f9eef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675876029, "uuid": "04691ab6-4456-4e89-b8e3-bdbe94ca9ed9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7050a21c-a768-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675830252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830252, "uuid": "a22fae76-6db3-409b-8aa7-f700f67423df", "comment": "Malware payload (Amadey)", "value": "b587704bd857e0148fbca303e95fc45b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830252, "uuid": "79f0b9bc-a6f0-4dec-8b70-56eb8fe41276", "comment": "Malware payload (Amadey)", "value": "bad079de52a3cfbc3e8f67fb288fb1be45619d99ed7d81cc437080975326e7ba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830252, "uuid": "e675fedc-de30-408b-9d67-847c38b1b82c", "comment": "Malware payload (Amadey)", "value": "e84f70d019851b698c7cf542886ed8d241f0fb4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675830252, "uuid": "2f6c27dc-2bb2-41dc-90a3-92adea71a605", "comment": "Malware payload (Amadey)", "value": "88ba569680d6dbbd7c1fca0bddb98b0be6855930e1ff0a3d3481cb3689ac4b194694ed460d393128ccd1ccbb7c07835c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830252, "uuid": "e0dedc05-2517-4f52-93f3-574ea2739046", "value": "T112B40207E7EC5532E8B567B00CF602D70A327DE05A78876B324F7C6E48B2660A635767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830252, "uuid": "e0c9c50f-9c71-408a-8741-8026889b8f50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830252, "uuid": "c1e8562d-5880-4921-984e-971bbe9bf05c", "value": "6144:Kfy+bnr+Jp0yN90QEeKq9HiyipDWsc11YZgjW1oNLnDBwBoJMl9gFqRO:1Mrty90srjsECWjAopVwaW3gcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675830252, "uuid": "cc89cb0d-1ca3-4525-849d-5c536a51615f", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675830252, "uuid": "04e5f092-cdfc-4547-a70a-fc729841b5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675830252, "uuid": "17464996-4342-4140-8e67-98f27cd2b09f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e215cb-a7e8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885267, "uuid": "a9b855ca-737f-48d6-9f5f-9b12cb1083b9", "comment": "Malware payload", "value": "8a5f018eb2c91dbcda395b5b58159dfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885267, "uuid": "3756e4f9-329b-4df6-9d83-9e5616442dc3", "comment": "Malware payload", "value": "bb5e7b05c53235912b95e18fbef232ff31502ef32d395cb9b56087d3bb45f9a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885267, "uuid": "d5cc6b01-af1c-4ba8-b2b6-1be3ca812f56", "comment": "Malware payload", "value": "7914d1ed8e8f201392ebeb4b659e7e7aef21a4d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885267, "uuid": "21258d51-b780-420a-b5aa-7b28c65a2891", "comment": "Malware payload", "value": "363409c8fd833c7cf7e8e29a5fa0eb9506cf5ce00c9b3a7ce5e77d550dd203aef5cf3429a47be2f2fc379cc7c5e8635c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885267, "uuid": "f4f77307-7205-4041-8d17-4fa411e9635f", "value": "T19C1512086E55AF18D63B43B0502593214EB7C8AAE820DE665EF3748F6D77FD052C0AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885267, "uuid": "dc07ad7f-3fc6-4e7f-a572-c6fed3e1c2e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885267, "uuid": "3d9f2f89-a648-4985-b1ef-abd5aaabe3e7", "value": "24576:d4+fvx+E62PU9lamgtV1JZjN+QuFUNknJJ:f+E0lat31XBlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885267, "uuid": "2e076a8e-d1c6-4954-ab9f-ae77f08ff137", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885267, "uuid": "2e7a56a0-1c50-42bc-b73e-3ca11d86d606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885267, "uuid": "a60c537b-d2aa-41f5-9ca8-a2b958bc77a2", "value": "8a5f018eb2c91dbcda395b5b58159dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f932d4-a7b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675861640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861640, "uuid": "c28b672e-9e78-4b56-967c-2ac26de23e04", "comment": "Malware payload (njrat)", "value": "48e9ef3764e7794751e73cba5cd3619f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861640, "uuid": "f9f6c073-0ffd-4553-af81-8b37a4ebd9c9", "comment": "Malware payload (njrat)", "value": "bc31611b03fe427b9c70459b01d95ed5c173a481efc56aabcdfdc0c0808cc347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861640, "uuid": "89e9f196-423a-4279-b1ec-17f4a7d91390", "comment": "Malware payload (njrat)", "value": "df8aa59621b0020a39d4cca4c8124b6679f102f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861640, "uuid": "1cc15b0d-3cb3-4f41-b89b-b4c59cbb349c", "comment": "Malware payload (njrat)", "value": "a0500209b83c3be42d42471ca769b3125666c61243566c060952bc3ec60ba0df50d934a01c1342fd75636634e3fa6651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861640, "uuid": "c8aee3de-395c-47bb-89c7-ab0ee52f459d", "value": "T1B2B21A4F3FA98856C57C177486A5965003B4A1870423EE2FCCC564CBAFB3AD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861640, "uuid": "1f87e4e5-42e2-4712-8c24-72cfaee9908b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861640, "uuid": "6b03478b-49f8-4223-bcd3-9824a62a9cc0", "value": "384:xcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ1N:S30py6vhxaRpcnu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675861640, "uuid": "73edaa26-27fc-4acb-873c-20f50713ee39", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675861640, "uuid": "cf2850ae-67a5-443b-b55e-9bc515863002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861640, "uuid": "21f8ce48-4df3-4272-91b2-9716f6ccfcb1", "value": "bJ5g.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e80d946-a76a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675831000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831000, "uuid": "14dfafd4-f0d7-4dfc-9296-7ef1740bc876", "comment": "Malware payload (Amadey)", "value": "43d6755f261b6b06cdd42ba1a05d91f5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831000, "uuid": "8210e85b-0414-4390-86eb-a97ca7c8d9bc", "comment": "Malware payload (Amadey)", "value": "bccd9b5d18943b9fd4d911fce5ce017248002be537da5122e10487e1bb31ac20", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831000, "uuid": "3df6c992-1315-4447-ad3c-16853f8334c7", "comment": "Malware payload (Amadey)", "value": "d19b7cf22d3904cb072921e4085b7fbae268cec7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831000, "uuid": "c0d4a6b9-f219-493d-93d9-9758454b8c33", "comment": "Malware payload (Amadey)", "value": "a4c5f574db5b4b72f41f054b4bc3eb7f525c3cefc6c9f4b989f2ad969537592c9e41fb535dec5cfa4f0c0898706e0922", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831000, "uuid": "ae626cc8-26a2-4c9e-ab64-f21eabc33c7a", "value": "T140B40247F6E88477E8B667704CF742C30A397D71AA38879A364E6C5A1872570B632337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831000, "uuid": "c6c8fa5a-7998-445d-891a-48e1758c9209", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831000, "uuid": "2f7ac4ce-3e8c-4623-8b6f-b8848da943aa", "value": "12288:AMrly90c0wmrWr9nCGLD9r14f9G10cv75KUisBGu:VygwMWrJCGLxU9G1l1KhsBGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675831000, "uuid": "b9a390e8-d326-4861-b661-5c9b2e784e76", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675831000, "uuid": "f3f5d533-ba59-498a-8715-aff378e46ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831000, "uuid": "e188ac6d-667c-4262-94c2-5fc1ab9c3ea3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09119da-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675883161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883161, "uuid": "1f0eb745-168e-4b45-80a6-e0aa5a464340", "comment": "Malware payload (SnakeKeylogger)", "value": "f5775a3cf643412413b4bc5a457a6ffc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883161, "uuid": "cdafbc0d-53a4-43d6-92ce-918e733b0420", "comment": "Malware payload (SnakeKeylogger)", "value": "bd0fb6293a5c6021464e49fa57b996fb3a6ad084c1683292a25968a9c01de4ac", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883161, "uuid": "a1c975ac-3bed-4a9d-abb1-7407bc75c7b3", "comment": "Malware payload (SnakeKeylogger)", "value": "b26088684fe0021a02677b9994d2d880abc5d270", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883161, "uuid": "9f75f497-c6bd-4316-8834-38f2d9659cfe", "comment": "Malware payload (SnakeKeylogger)", "value": "5d4f68c9a0dd88213d6746257fe4338834f15811d61d7a37ed4b9ca6673169fc6bbdcdc72b6b03663bdcd6036dde9c28", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883161, "uuid": "ba83638c-ed97-4850-af88-e5fceef7a8c2", "value": "T11535E007E67AED2ADC22C57CDC5F148282129C7DA944CA0E21C2B72FD6327F1593EE65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883161, "uuid": "b4d74c10-23d3-492a-b688-cdf11e5dd2f7", "value": "24576:EFejyv2JDwfV7FevhEezj8gHNXE8f4fHXz7iIaQK/:IEyGDwNZM+OZHN7f4fHXz7gX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883161, "uuid": "751d61fb-b84d-4a60-aef1-281f0b7b210f", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883161, "uuid": "1503063e-8f69-4e0a-873d-868a7d131283", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883161, "uuid": "10fe1035-a162-4a88-8ef2-8362692a2299", "value": "xA362,271.03 .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276b091f-a7fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675893265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893265, "uuid": "5f4fb67e-46c5-48d5-9c65-bfe75cf0c676", "comment": "Malware payload", "value": "6c378367e4d77da2e1314427c9afd31e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893265, "uuid": "f7efad94-25a9-4f60-a687-7a4788515c32", "comment": "Malware payload", "value": "bd6f2eb73bdd58a664b96e9d3b39b06f98aa5c618408a44b99d7ba53a9021e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893265, "uuid": "f819b21c-7f4f-4575-b3cc-918b4175b1e9", "comment": "Malware payload", "value": "27a479589d70d3115b50ed01ffe19efe164237d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675893265, "uuid": "cb4e9ece-5496-41c0-abd7-5c8bd9350d37", "comment": "Malware payload", "value": "01e3818b59edcfa665168e7aff29c661e4b6b0bafd540df51672004adcea6d5e182978d4378d344270a302eb9642e54d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893265, "uuid": "249b119d-9780-49d0-9a67-3d36b415a04c", "value": "T15DC40207AAE84032E8B157B419F706C31632BD616A38839B378B6D5D1D723A4F53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893265, "uuid": "f85acb26-cdcf-4048-9bbc-737f7c1d50d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893265, "uuid": "663a5449-071a-43d9-993a-7d17c27f82a4", "value": "12288:CMrYy90KAHhaYrASYVXeEyIYt22rBSN0igZ3PBOIKpPn4/bFD7Uxf:KyjAHhLuVXe/IYt28BOxP/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675893265, "uuid": "63ed566b-dd18-4cbd-bc75-7ae059129b6e", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675893265, "uuid": "e17a3573-e3ad-4524-9862-e0bbdcf82aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675893265, "uuid": "a78a716d-a1e9-490f-8447-76496fa690ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309ee268-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675882114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882114, "uuid": "e6335a17-233d-49ae-8472-8687582f5f19", "comment": "Malware payload", "value": "ca72e64347f1e8db097d5ea110005e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882114, "uuid": "8a75851f-7506-43ed-b6c9-4b7ba24bb5ae", "comment": "Malware payload", "value": "bde8b4c953923c9671baf4d6fcb9a29734c05f0a714de73edd209e7370c42c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882114, "uuid": "65ae56d0-849e-4f25-8320-adf912ee0539", "comment": "Malware payload", "value": "e974cc586c17d9df3991d0f193c8ba90a64afc57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882114, "uuid": "45172e65-f323-4c45-97b3-eb0b493c984d", "comment": "Malware payload", "value": "d47c9f2d9c47702f95c004d319e3242cccb39c5bbc3f51a9a9ea5ddd2da8b697d28d27c50680849d47f81700a54794b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882114, "uuid": "6ff63dff-5db6-46e2-9a71-68b362b60870", "value": "T17856334C9387663DED88A97C848B072AE750CFDA17B4511343D1768FB8B148F6DB368A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882114, "uuid": "2e8636bd-f07a-40b1-8519-268974c6ac5a", "value": "c9a3edae9204609d90d0770c3583acd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882114, "uuid": "41a1eae0-0d5a-445c-b69e-33c6368ad576", "value": "98304:QmrXgqHU+DTwl9zOHz7t1Q5RRlWY9HJ3CChZfYQmGkHxEW6jixpTYR:lXg4U4TIqY5BZdwnGIkjixRYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882114, "uuid": "efe439a0-96b2-45dc-9b13-c41f402cae19", "value": 6312084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882114, "uuid": "783f2d8d-762d-4f5b-8b53-9b2b17224a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882114, "uuid": "238199e1-b9da-4da4-b8ab-793f906452ac", "value": "ca72e64347f1e8db097d5ea110005e3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a529c8-a7b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675863927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863927, "uuid": "7b6d559d-fb39-44b0-9b2a-f3468722c16a", "comment": "Malware payload (GCleaner)", "value": "7a80accd6674bbe233697564076adcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863927, "uuid": "9c6ff5fe-15ee-41da-a03b-8d5b45caddc1", "comment": "Malware payload (GCleaner)", "value": "bdf3185bf3495e0d69e330a8a537422da261f5d07701c44942ef4a7e83725fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863927, "uuid": "2faac888-7c3b-42f2-99b4-a8c82eb51f06", "comment": "Malware payload (GCleaner)", "value": "53b8b1c5a9c7da965092cc7d7f708933cc676b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675863927, "uuid": "ea1d2dcd-3d71-4b4b-9298-b11fb598256c", "comment": "Malware payload (GCleaner)", "value": "a72184f048c635cf9225c8d12f95316ba233e455db43b7e455c32848822e482a6c85bf9f2cd4f612051fb836865b6425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863927, "uuid": "68b354ac-29a5-4667-ab1d-9ed34b6fe8fe", "value": "T185C5127C7601C8ADD280FEB4893A98EB5CD66EE3E9D4606370D9BF3F957E184460A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863927, "uuid": "5da4b430-589e-4c03-831a-caabc0867089", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863927, "uuid": "bab2bb69-ee75-4e45-b5ce-85b472c1027b", "value": "49152:rdHm3EFcR9kWpj++DiL74agmPsDWpjhVlHgnpLCgv2MR:JHm0FMryn74xmMshrgnFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675863927, "uuid": "0cf4cfbe-cc07-4d03-ba3b-cd29a25edea8", "value": 2681524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675863927, "uuid": "89822259-68f2-4c0a-9fd5-179bbc92ca34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675863927, "uuid": "d6eb2a08-81b7-438d-b996-a73558f2d3b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f4a180-a7c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675869741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869741, "uuid": "6deac4d1-63cb-41ec-b781-e99c52a880d9", "comment": "Malware payload (Amadey)", "value": "fc358ac392f56790904e91cfec63dcb3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869741, "uuid": "b169261c-092c-4945-a52e-7af706f1857f", "comment": "Malware payload (Amadey)", "value": "be627a49d4de24a9fe815b7ac226d85deac8b03b22ffe82097d46e041f1f44fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869741, "uuid": "2b28bea1-552a-47db-be2f-0355f4a87851", "comment": "Malware payload (Amadey)", "value": "88b65dc3e63d87827eb135b7ec23081f38f96e98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675869741, "uuid": "62b352be-d4b7-4982-855f-362fed99509e", "comment": "Malware payload (Amadey)", "value": "9b8461bd434345b08e6065b20ec439fa5e7ee05e6000d03d6eaa93e2283ae8967c7a0e8d5f5345627cf9732c727e1b99", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869741, "uuid": "c78b1d8b-d925-4259-96e7-b9c33f8e8baf", "value": "T156C4121BE2EC8422D9B427702DF703C316367D50A735879B665E6D0E1CB26B4A27172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869741, "uuid": "749046bb-9866-4b4a-bbf5-217754dcd521", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869741, "uuid": "bf1593e3-a9b2-4055-b632-f4c752d756f3", "value": "12288:HMrBy90XAsAUfHgvv5y6Hu7qo2N0RYaAFA:qyls1zPqo2NEYaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675869741, "uuid": "4078174d-e909-48cf-b0eb-d36a022ccb70", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675869741, "uuid": "9cc54a95-6ed2-4d23-914b-8dac7439fadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675869741, "uuid": "78992970-05d6-438b-bdb1-1a28c0befd33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d12dfe2-a7d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675877383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877383, "uuid": "62935498-554e-4c78-8ef0-634bae8d494a", "comment": "Malware payload (Tofsee)", "value": "6369fa0bc6a8c4317cb2e407b20f3252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877383, "uuid": "253c1fbe-a733-4028-b24f-f0f4d4804d72", "comment": "Malware payload (Tofsee)", "value": "bee63114e4d956c8f4d2646303799174578b072906e43a5d6727a13fd342b89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877383, "uuid": "8724d86b-c65f-4c49-8055-f8f0587258ae", "comment": "Malware payload (Tofsee)", "value": "4f7af5b3422db3dbd43a3314d73b8ab31ec26dcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675877383, "uuid": "5541a01b-f5f7-4653-b937-8629d194d1a6", "comment": "Malware payload (Tofsee)", "value": "c1d144bc0a5e45546a2a7671a9e0d82c5e109806fdead85950f0538da7ff522901978cc65e7d6ab4ad4d0b03fab91a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877383, "uuid": "ddb1030d-9b28-44ab-a33f-be87343d3417", "value": "T197642A13D2E1BC81F9658B369E1FF7E8765EF5608E4AB7653218DE2B10F0272C163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877383, "uuid": "f8289e8e-70cd-4abc-9c42-474196f37b75", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877383, "uuid": "48b02940-20b2-46c5-a922-cbf9ff978460", "value": "3072:NPgVMwuszxR9B0Wj3KTIvQP4rTbbZNqtrkSnHqlxddyvtsWQDiuLpms7JqvJ:NwMO5QxPuTHZNGkbxdd8KLiqIvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675877383, "uuid": "a70bc883-7f9e-4718-8e95-f74934b76f9a", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675877383, "uuid": "bd519c22-86e1-4b6c-8f57-6fa29162c8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675877383, "uuid": "2c5c3efa-84ac-40e9-a5b7-78e8f3e2221c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20fe3c8-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675881016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881016, "uuid": "e622db02-4c24-4e53-8248-d67a5ee3df73", "comment": "Malware payload (Tofsee)", "value": "8d89b174b12115075cdbcddbf73b71b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881016, "uuid": "6467d91c-a291-4477-af66-03030d8f2257", "comment": "Malware payload (Tofsee)", "value": "c0a5a817284f2576ef81d7def0824fa7c88fdf2c95cfd075584207d0b7d7c873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881016, "uuid": "ed3d7d78-9314-4f9b-91c1-d0f24247dd5a", "comment": "Malware payload (Tofsee)", "value": "c25f6671f36494787d9f4287ff7d84bf6ea22342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881016, "uuid": "02d9882d-e801-4a98-aaf1-974197a1861b", "comment": "Malware payload (Tofsee)", "value": "927498082b6010a690b8d302357d23b173839a858343531f93bcc45de7b13a6cb497151166fde1c9173565f1a8004817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881016, "uuid": "dd6a1c45-3bc9-4fa7-9cd5-6ac37ef8261f", "value": "T1F0641803D2E17C81F9258B7A9E1FFBE8765DF5608F4AB7693229DA2B14F0172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881016, "uuid": "cbf2cabe-7fe6-41b0-a095-0e7ed76b3b0f", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881016, "uuid": "470e4cba-8abf-47f3-8351-a521794e7cdc", "value": "3072:yPgfe94dxR9SLUZfegJ7MUaQzOLkyQs0T4bsDksWQDiuLp5+YuCQv:y4nrSLAGgJ7yQzRyZh0BLiqlEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881016, "uuid": "f86e979b-701b-468e-89c9-822d765a0d37", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881016, "uuid": "f24968d3-2f78-40bf-9a25-bb34d423a02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881016, "uuid": "7ceeaf6e-dc87-4f45-85aa-43b26abe653a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1d4875-a75a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675824284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824284, "uuid": "9769bb53-77d3-4546-9cdf-6c6f5b2e7da9", "comment": "Malware payload (Amadey)", "value": "ac29a637a27f9bd4ff4187405e34aa2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824284, "uuid": "73718d8a-1916-4601-a9eb-d9644e4ed37b", "comment": "Malware payload (Amadey)", "value": "c1797c77b2c4122339b8da3cb94ef5f4cb26c8ca8fe6d8180f6cccd9e6d150a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824284, "uuid": "31c88352-975d-44f3-aaba-a4c6953c85b2", "comment": "Malware payload (Amadey)", "value": "f214b6278002adea45fd42dbf836be53b5d2626b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675824284, "uuid": "bd868dde-fca0-4af1-9bfe-4e71eee6c98c", "comment": "Malware payload (Amadey)", "value": "a6cbe0f8ec2d5fbe99fe0b4802490debe023b867b75d7c34afd7dd98aa1e67fa69fa2c483b8e15e90d9e14dfaf38617b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824284, "uuid": "355e4154-e827-4263-b0fb-3515c52a0369", "value": "T194B4024BF7E84162EC746B7008FA07C31A3BFD6057788297164EAE6E1C72658A13176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824284, "uuid": "86376957-9b5a-4517-bd33-72e755f1d83f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824284, "uuid": "559c06e3-ea89-4fbc-a16b-8cfe5b1a41b2", "value": "12288:BMr3y909pdj42gk2P46RXcPVccZaajj1JjNxjU+:6ySj45P46GecUajNxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675824284, "uuid": "a21214e9-9f3c-498e-a5b1-89fefa0a0965", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675824284, "uuid": "98cd124f-2fbb-4667-96da-75343fd28fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675824284, "uuid": "17dded37-f0e2-4305-aa81-2dd32adf16ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4609cc9b-a79a-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1675851656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851656, "uuid": "b223c625-8b84-4f1a-ac60-13d0e6d23bea", "comment": "Malware payload (EternityStealer)", "value": "3ad83c5134fdeae82110dc1078fafe14", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851656, "uuid": "9ba67669-6470-420b-81d8-dd11e03be07b", "comment": "Malware payload (EternityStealer)", "value": "c28ec57a7c8ae5cffc2844cb7f0ea9cd9b0740e0773aeda8c34c7a611b572d31", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851656, "uuid": "9dcd4740-1b8b-4d4a-a5fd-914c2f9ee008", "comment": "Malware payload (EternityStealer)", "value": "cccdaac52dfba194be275a9732e4e678345df015", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675851656, "uuid": "b05f7e5c-7da3-40c1-b74f-09b8cd9df2e0", "comment": "Malware payload (EternityStealer)", "value": "1e85260fcdacc545a2a0b115dcfded87116b21b73b0d7b37f041f394ac5f1f317fc5e8edd82cd4fba31e918cce3dbeab", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851656, "uuid": "b54827da-b937-48c3-8b38-912ef35e844e", "value": "T18744A4243BF9161DF1E6963D5D67D122C3257663260FB30FA743F1EAA911609CE03BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851656, "uuid": "6dac572b-4116-44eb-a9c5-3e2dfb93b21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851656, "uuid": "355d80fe-f22b-49f4-a331-c97de5aea3bc", "value": "3072:hOoE2kyosC8jbwJi8i7idEDQ8QHzQOj7D94ZKlTSDgrLp3DPoLJfL66kyG2jaZ:/bwFD9PlWD093LCf9kyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675851656, "uuid": "a7886420-1581-4b33-b493-1ab1c5a9184c", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675851656, "uuid": "599e7cc8-696b-4df0-889e-274f34be7eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675851656, "uuid": "2f0d1469-e798-45ee-84aa-c653142b4423", "value": "eternity.clean.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91fa120-a74f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675819636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819636, "uuid": "4e0b89e0-5431-49ac-a088-2aad5029cc84", "comment": "Malware payload (Amadey)", "value": "054c633031a1c5f67e750c6b5e3d2fac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819636, "uuid": "0d1998bd-218f-4fc0-bb5a-4191627e11bb", "comment": "Malware payload (Amadey)", "value": "c2e5bb46b64168caa80cd4dd892d7841361af36e428151b947d9a1d36a289326", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819636, "uuid": "09c8828e-4804-4de5-8715-a0e92dd78bf6", "comment": "Malware payload (Amadey)", "value": "0f62f1b91d1ed64985595b5e5e39257de2d2f8d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675819636, "uuid": "7306b5e9-b2f4-4f65-8070-c29b35c858a3", "comment": "Malware payload (Amadey)", "value": "cabc5a62565acc2a7e0beb995032a8d0f39852668347b29195215148728e74941c9ebf5f87735d6fff537e346d07aa80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819636, "uuid": "fcff5119-dfeb-4b98-b35d-739f9dde3539", "value": "T109B41207EFE94422D8B847B509FB12D31532BD904E384BAB634BAD1D09722B4B636777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819636, "uuid": "560fa452-65ad-46c9-8ad6-c1ca61a10c5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819636, "uuid": "a594f2d8-035e-4916-a486-200225ad1ed7", "value": "12288:5MrQy90bdfGUVzdlxU9qQlFdVGRvLWDpV9cG/aRMy:dyCLVZclFrcWNvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675819636, "uuid": "59f1aaae-867f-47dc-a653-1f3f5300ea15", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675819636, "uuid": "b7e4200a-cbea-49ee-9ca1-5832409d86e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675819636, "uuid": "d703fe63-8d59-4472-a6fa-41bb41c63e3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bfe6e6-a7e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675883030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883030, "uuid": "8c075d1e-6212-4b87-866a-57ffa08645dd", "comment": "Malware payload (RedLineStealer)", "value": "61f59906d00456c6a5010a04582fdd56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883030, "uuid": "4a749651-9e6e-4809-950d-f06e3c79a264", "comment": "Malware payload (RedLineStealer)", "value": "c2e6b08bce56c265b9e651a28bbe01d81092465beebf853fbf6cb0094deb5bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883030, "uuid": "d8e4e1ce-f8af-4846-81b7-07c4dde31fc0", "comment": "Malware payload (RedLineStealer)", "value": "4137ed1a0fbb94f387fea965a07596c8dfb77861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883030, "uuid": "42a9ba29-6347-424d-8ddf-95e10acb5b85", "comment": "Malware payload (RedLineStealer)", "value": "12b6c492c1be42e9b4724a60e11880cf771895da812ffd923dc6953ebe438f42068777052a9a324fe0586f86ae2f172f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883030, "uuid": "c0d9eb32-ab23-4fe4-9e94-089e2d33f71a", "value": "T113945B03D2E17C82F9658B769E1FFBE8764EF5608E4AF7653218DA2F14B0072D163690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883030, "uuid": "962b26bc-7190-44bc-97b9-4b9d6c5326ff", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883030, "uuid": "eb5d5706-fa07-48e0-85a4-0ddb4ccefa80", "value": "6144:qIsrEGKhzqn44dzhxvNq9JBL+aCbKHhLiqJv:qfoGOC44JNmEdKHRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883030, "uuid": "1dc1efa2-1759-41ce-8a93-33c70ef40b10", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883030, "uuid": "90a55c68-fa79-4299-af05-88c5b8ec35ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883030, "uuid": "e9b322da-5f0c-4ec1-b273-6ce5b3cba6e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52f4927-a783-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675842017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842017, "uuid": "bac57f73-06a2-4562-9cbe-32f4e89dd9c3", "comment": "Malware payload (Amadey)", "value": "382a9d4f1469abd09d702cbbe79225af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842017, "uuid": "6ce97521-6953-4d59-9424-8c29b472b7f1", "comment": "Malware payload (Amadey)", "value": "c3131e6df64a49dec9b5881dd5190859327efafc7addc8cdcfe6b9476ddbefc1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842017, "uuid": "8c4f99df-0aba-4cb3-a27c-4c53207c6b94", "comment": "Malware payload (Amadey)", "value": "287ef1081a6148739bd4957c685ab5d002b3ee0a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675842017, "uuid": "906582ae-82cf-45d8-ba72-0219df18fdb2", "comment": "Malware payload (Amadey)", "value": "94fcf7788986bea703ff0a8c24756be32e90f84a9926c7b3a06e402cff0e28e3e483c30320cc3793dddfe949ee2b7483", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842017, "uuid": "4b140683-1789-41af-870d-ecaeb8c58241", "value": "T168C4020BA7EC8476D8B05B740DF203D31232BDA19A38935B678F6D5A1CB25A0763137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842017, "uuid": "d083751a-7624-4fed-9dd0-f2908902f9a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842017, "uuid": "b5305f0d-3d3b-44a3-82ef-f753aa2c77c3", "value": "12288:gMrKy90K0G/UVZL051X/lIRQNxdPSRuVsWTdf+dS:6yGlVelIRQBPpVsWxf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675842017, "uuid": "77afb1f7-7fd9-4a82-99a8-91db7680c162", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675842017, "uuid": "2701acff-57ec-4253-bfe5-23e884dde3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675842017, "uuid": "604368f7-77af-49cb-a44a-72b293a51a9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96059a11-a7b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675861239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861239, "uuid": "23cb5c9c-ef85-4af8-b887-6a8a4c68b8f5", "comment": "Malware payload (Vidar)", "value": "6b547d1da1d61dea80abd9bec8d2fd3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861239, "uuid": "823076e8-9575-4c2c-b408-08ff13cf5a7e", "comment": "Malware payload (Vidar)", "value": "c3b25b89a0523486ba5b6da256cebcaf4bc386c9ce5c38047a2b6efc054d2d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861239, "uuid": "c5dd2633-b010-4ced-b51e-a36117406fbb", "comment": "Malware payload (Vidar)", "value": "6fc46301e375366a9c1349507ebb6ac705fa22cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861239, "uuid": "19e4c371-3425-4fee-875b-a7fedc29bfc4", "comment": "Malware payload (Vidar)", "value": "23b316bd9d67967ae838c911eb170c208050e84d5e59509f9e8f541b79c060f4e959f51a00fdff29cfc3ba76a1d67b17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861239, "uuid": "09f5376d-2a7e-48be-bd02-f4edadf71295", "value": "T18BA4DF31EC948172F563903469678F13E06DB8A0276098C7B7961AE53E753F0C73BAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861239, "uuid": "b5f3761c-f4f3-435d-b3c3-005b8d95ed76", "value": "9b78ac986c9f2e3a27f57df355009bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861239, "uuid": "1edfa053-b52f-4057-b433-dcdff96a1c5c", "value": "12288:POO8GlbYax2Q2ceYFXphphgJviDyoZBXhd:LNBbhesjpGqhHxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675861239, "uuid": "ae87ca77-f25c-4ee4-93c0-cff0324ba8ff", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675861239, "uuid": "3305d58d-488d-4a69-93af-9bb4a6d7f0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861239, "uuid": "efbcc46e-251a-4a83-8f7c-0a08f68b68c7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8c0df6-a771-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675834302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834302, "uuid": "90046805-04ef-44b0-b7bb-3a2ba45cece9", "comment": "Malware payload (TeamBot)", "value": "bcde1dc8e93f8b260586afff22acce04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834302, "uuid": "ca26ef54-86eb-4981-adb6-150e908c3a96", "comment": "Malware payload (TeamBot)", "value": "c42db42f425a1a1cc13a1023b9f4d032a5283aec57f05a4eb9912209eff168f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834302, "uuid": "f1aae771-e0ea-4ccd-82f0-64bdf2b06193", "comment": "Malware payload (TeamBot)", "value": "2faba3fd359f9bc0e47c1b06f01cd16029b60064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675834302, "uuid": "eec50a6f-f57f-4d35-9698-5b34e15b61c4", "comment": "Malware payload (TeamBot)", "value": "ce8a2b3b24a882c15c09afbbff29ca0e8e3caa17d8b6d6878404e85f1539a6f6cb58c9e8b4f000edfae9ecb8edd5636a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834302, "uuid": "617f7af2-c8e4-46bb-9f38-ae032d9f3741", "value": "T14F14C02235D0C0B2C5BB17704C64DAA52BBEB53156F5CA6B37A807BD4F302D16A3A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834302, "uuid": "93fd07f7-aec5-4920-aa0d-0df39b11143d", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834302, "uuid": "5a21baa3-616c-4d97-997e-6b36d547b7ce", "value": "3072:2efcOUPXijLO1L2SQWQWa5fy0ccQUO9jVC3HUEH1QVNxSAT2:Bfc/UyLXQx3O7C3HU6eVzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675834302, "uuid": "731694c2-edb2-42f5-88f3-8f9a5ffaa2a6", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675834302, "uuid": "00c912f0-26e2-4402-ae08-08be71aad36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675834302, "uuid": "64109a09-4d68-4dec-8478-66e497ecf62e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7fc947-a78e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675846517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846517, "uuid": "2b5f86d8-6f93-4e48-a3bf-bdc93a88fd83", "comment": "Malware payload (AgentTesla)", "value": "03d6111b38a02d8d3416d04f660b6d8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846517, "uuid": "ea35fb49-5e8f-43e6-8fc0-472cf4f78047", "comment": "Malware payload (AgentTesla)", "value": "c4a1d021cc3f56cde4c663b53028e21920dcf03bad74f0f842c048d9bd3d205c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846517, "uuid": "54dbd926-bd3f-474d-b4e1-133c69f3c841", "comment": "Malware payload (AgentTesla)", "value": "20fe05086c2f2c821efcad4e8f6acb6c631b7a86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675846517, "uuid": "736d87f6-523b-44c8-a8a1-4e3be7738e47", "comment": "Malware payload (AgentTesla)", "value": "44822682590d3e73cefeaca7187b9087f3814a350fc278f9ba24831ddb1876c82a22821ecffa43c934677fb0514198c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846517, "uuid": "9fc11155-18a6-4ff9-8034-b59684b9570f", "value": "T1EFC4C33E69BB57E2C578F97586E18420B5AD83823303D999DDDA2BC0CF0128A7DCE55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846517, "uuid": "783231b0-4a6b-4c41-965e-a72fbefd80c9", "value": "12288:HcBXiEZz7yDne7f4WYMTyPdLX2tuCAe/ZXazVt1Ek6ugpRZN7gNFSxCDH:ARJe7MTyPdLX2tuCAe/ZXazSkKacxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675846517, "uuid": "4b9f8ff9-e211-450d-bee2-0c78fe0d7142", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675846517, "uuid": "6e38a5e5-4fe1-49b7-8da9-770aac5fb888", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675846517, "uuid": "de35ca41-bf28-4aa8-9161-0d4228168556", "value": "Credit Note.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa91bc0-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881012, "uuid": "0af55f1e-5999-48fe-96c7-ea6590c82659", "comment": "Malware payload", "value": "610e64bec7a88bfc0c322d87d6bace4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881012, "uuid": "0579c623-f327-4e8f-a06a-2da96a9be3cc", "comment": "Malware payload", "value": "c4aedd9026f7ab99c0d683d6a49ad6daa14d1efad7c6c0df968cd4e13fc27b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881012, "uuid": "bd8a1f6d-7057-49ae-8836-3032abceaf91", "comment": "Malware payload", "value": "d7b27e28aa0efd01789b9585788331f1286d1040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881012, "uuid": "52e9f849-ab9c-40c7-8950-7fd074863e2b", "comment": "Malware payload", "value": "e4f3c744c8ba38d457a233d32910bfa562b0785de05513105fba058bc0ee8096a0a78df1aa158096eaf6d236a6b069d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881012, "uuid": "6cebf8dd-8ce4-4918-a09c-436d7c7086ec", "value": "T134537E23B7838C75CA6573F118755BE68278ED35176512C3B3943BAA9E300C36EB2D1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881012, "uuid": "7c4f69b1-5e48-4677-9cc7-67d534c36cb0", "value": "aacbd2b8c4b3341605ae4adcc2530b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881012, "uuid": "3cea749d-e084-4f40-a6c4-7c65e1a2b8d3", "value": "1536:Vk7+Egtd+avCTz/rC+XAVLn6rkwOteQVJxEM:woBCTzjgLnokw6eQVgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881012, "uuid": "a7203d3b-250b-4101-aed4-a6c58825f33b", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881012, "uuid": "a67f3971-dbcd-4a66-a43c-212d06827c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881012, "uuid": "8748c827-7211-489f-a608-9673e29f5bc9", "value": "610e64bec7a88bfc0c322d87d6bace4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc7f611-a7e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675885548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885548, "uuid": "34e996ee-0b24-4418-9e96-d09b437540e3", "comment": "Malware payload", "value": "352282ae5806d671a8856f050f5841a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885548, "uuid": "e555c5ff-413a-49c6-b998-30b1f4953abb", "comment": "Malware payload", "value": "c4b739198f4e70cc84b8a29819358daa83597f34462cccdf8da29f9a4fa50f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885548, "uuid": "cd7d2c10-3187-45a9-90eb-d8e22badf7c7", "comment": "Malware payload", "value": "e193f72084e18f4a33f603dbd9b2f4d24b740a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675885548, "uuid": "ff396dc4-d32c-4374-bc34-7962c5f856d3", "comment": "Malware payload", "value": "11392a4e7aff9f187296ae04c96ac87cc9921589381ebd45a85e6516e16975c3b3928ac541acaae27c5f33833421ae4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885548, "uuid": "9413d339-4c94-4947-8b52-2a48617a81d9", "value": "T1FDD36C15B4C1C072D96728321930DBB69E7EF8300F246DDF67981F7E9F202D29635A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885548, "uuid": "3f72229e-e42f-45e5-9642-d88ac89381c9", "value": "8b99bbe1c3b502f6b126944d2de443f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885548, "uuid": "617eab66-7048-46d8-9bed-0e784f8f065f", "value": "3072:i8/VApZl5zAahB52drrgaduBv85MTVd2sakX:i8szAu72drrgN3TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675885548, "uuid": "b9023103-4965-4999-ab0d-21f850b8b08c", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675885548, "uuid": "c423882b-0d36-440b-ba27-b6598ba412a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675885548, "uuid": "e57185a7-0285-4ed7-8293-fba8aeb712bb", "value": "SecuriteInfo.com.Variant.Jaik.95172.25.28870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf9dee4-a7b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675862267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862267, "uuid": "3ef199d2-0ca6-4ed8-8f7d-c0ba9943d2b5", "comment": "Malware payload (Amadey)", "value": "c7976f995d7e120d24f21693eb0eddf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862267, "uuid": "45dfac40-4a81-4acb-b1c3-70fa281e42fa", "comment": "Malware payload (Amadey)", "value": "c52fc1fb0a7ea4676720837bdf2a0f23627b9aef8b970b0c93b642f4a7c4c79f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862267, "uuid": "cb0751e6-8b0b-4abe-9230-af3e30c457b7", "comment": "Malware payload (Amadey)", "value": "f92614243d8e54962bebd93b6a5f5f2064b3ce15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862267, "uuid": "6bc257a2-1a7e-437e-93fe-22f2b8fe87b5", "comment": "Malware payload (Amadey)", "value": "4117b4913245ca476cfbc79b21ab8e8cf39ba5100dec82ab08cebf3ca6a8bb1fe8eb8439b93a37662752a1114a945c4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862267, "uuid": "629f6b09-08e0-4bc0-bbca-d7afbc2fd038", "value": "T19FC41257FBE98072E8B55B7419FA03D30E32BEA11A79874B274AAC491C72574B03137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862267, "uuid": "d7aff51e-df96-4df4-a694-2538aa973659", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862267, "uuid": "037a8f5a-9da1-4a2a-b87b-2c9b6b352a08", "value": "12288:cMrEy90HJWCGVhSj+V2aH64eEarSasEmMMGQBFMZ/h:oycoxVm+Yu6OdasEmM/QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675862267, "uuid": "88f1a094-978b-40b7-ba8b-b3fc6873dced", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675862267, "uuid": "a0a21eea-3e38-499f-9dd9-768c02662d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862267, "uuid": "8f064d3c-2cea-41ef-9371-1e194737feaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e348c753-a7e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675883702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883702, "uuid": "f3dab8bb-7e55-4ce6-ab58-085c1bcdabfc", "comment": "Malware payload", "value": "5871bd8af4b736eb6e5238d3d3085027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883702, "uuid": "9ee48c11-4d7f-4443-97c4-d32229248d45", "comment": "Malware payload", "value": "c576b3a87ac07ff38f4dcbd14561186361b38cff36fa2f08b99ed4be80d3313a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883702, "uuid": "4b1b0dee-9e67-4a12-bbaa-d610c1a1c8ce", "comment": "Malware payload", "value": "be37db59e9a4ba68f90c43a7d71374e00749bac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675883702, "uuid": "5ebe9c0d-c43f-44f4-beb3-a83c11d653b6", "comment": "Malware payload", "value": "b153a4b6c9f23160531c53c00b9bb4990349ec20b67872efbffee781d98e5dbe74c631a67831cde7f0d5e2414390ce8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883702, "uuid": "6675bf99-03e7-4497-b113-5c619598c014", "value": "T1A9642907D2F27C81F9668B76DE1FFBE8765DF5608E4AB7693218DA2B14B0072C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883702, "uuid": "3f19f9e1-da1e-4f4a-bfbd-c7657e978938", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883702, "uuid": "5689709d-bf74-4cd6-bdd8-b255884b838f", "value": "3072:nPgotczuzxR9a/VWwD0+lJTerTT/8WgO1/1iEZsWQDiuLpUNtgvJ:n/95iV7D0+lQz/8WgOqLiqUMvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675883702, "uuid": "2d4e5b84-aee9-4670-a04f-5a1b84e3a922", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675883702, "uuid": "7e18efd9-7089-4945-b072-3e26e9f50aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675883702, "uuid": "70d5393e-bef3-4e0c-9fd8-f4a1e96c5cef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f177dc-a7de-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675880911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880911, "uuid": "8c0f9f4c-2834-4c3d-8608-4d1ba288e0a0", "comment": "Malware payload (SnakeKeylogger)", "value": "137df60a4c3a233d3ef5e260deba4217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880911, "uuid": "ee0f9c2c-5779-48c9-a399-d3a321f72635", "comment": "Malware payload (SnakeKeylogger)", "value": "c591ec47c2b8daa5036cb079a83f61d1e02bb9bb340723d3e6b9290f80e5f64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880911, "uuid": "2c74fe09-a92e-40c1-ad63-1d901da8fbcc", "comment": "Malware payload (SnakeKeylogger)", "value": "93ee87a2ddeb63c2071773425810753c98492ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880911, "uuid": "34ad15fc-1c49-457d-886b-0c3db865216e", "comment": "Malware payload (SnakeKeylogger)", "value": "ad8b225a02106e73bf00adf77e6eafd926282c70867408cb4e48ba34810db3992e27c077aed26360c245fa42be4d1678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880911, "uuid": "99eea7ec-e1c4-4246-a338-b0d253fc2863", "value": "T13F5412146BA8D4FFD8F65AF11D771BBBAE26F8232075960717946B843AB7281C00E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880911, "uuid": "839f36fa-9cae-4ddf-8f68-4228e58892b2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880911, "uuid": "705e9b1c-591e-4162-a3a4-9b1a2cbae0c4", "value": "6144:pYa6wXsS9JX4JB9ddYhKfvfAnXHqdQfJqIST5xpMl+e+k7q/c:pYCsSMBssfvonXHqwKxGl+e+k7qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880911, "uuid": "de78f1c5-e01e-4add-bbf7-213f1902a7d7", "value": 301544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880911, "uuid": "702c18d6-3a71-42c1-821d-977b410b07ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880911, "uuid": "e4b56cd5-89f0-483e-96a9-d1fe1a16c37b", "value": "SD987654567898765678Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d3ba09-a79f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1675853930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853930, "uuid": "c4a639fa-b765-4c08-b22d-467230cdad8c", "comment": "Malware payload (Downloader.Upatre)", "value": "471c33514ecadc4e4b476e1d61e2e67c", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853930, "uuid": "00f0bc03-525b-4608-8949-18822a50e04e", "comment": "Malware payload (Downloader.Upatre)", "value": "c595b70fd243dbee8f903cddc2b5af3a6c71ad8e243e1395fb8fd48efc09f43f", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853930, "uuid": "20f86cf1-f086-4e28-9d15-a8428090dbc1", "comment": "Malware payload (Downloader.Upatre)", "value": "40cf69a21b5a4e93e3fa0d95a0b7584e4c6c62f1", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675853930, "uuid": "deeebf40-a4c0-40b6-980c-7c655bbc350f", "comment": "Malware payload (Downloader.Upatre)", "value": "f73bf5e33ac74b36ed8da41b654c13a3d51ba6b416700aa1f7b689d6ccfc267be5c689bcc6eb65c6af035931898ca5cc", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853930, "uuid": "675f1d5a-3d04-4739-b261-017e74d0250d", "value": "T110C275382BE86A76E377CF7586F642C2ED75B4237C03D51D84A943494823F62DDA0A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853930, "uuid": "44581d07-c8e4-412a-a722-e1770e5de5aa", "value": "87d7d4c05cdecb10042741285457c05f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853930, "uuid": "f88b6932-0db1-4ec1-961e-2c36b5c78ead", "value": "384:MDbc8bto2VE+i3KUMl6Hj8HFgQgp80P3l5qTuxk:Ubc8btowgMlIj+tgrduuxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675853930, "uuid": "eba50eb6-695c-40ab-a06f-bba6b543d4e5", "value": 25827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675853930, "uuid": "a5cecee6-b9ea-48f0-ae62-bc8148b82a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675853930, "uuid": "6bb96786-7876-49e1-abf3-fe818b570bce", "value": "c595b70fd243dbee8f903cddc2b5af3a6c71ad8e243e1395fb8fd48efc09f43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e859e6fe-a7c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675868249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868249, "uuid": "fef4a4c5-55fd-4e00-ad62-0e463355c6c6", "comment": "Malware payload (AgentTesla)", "value": "bd786819ac76f02c763a55679c20f449", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868249, "uuid": "0d9fd817-f8f1-4efa-a531-573581266387", "comment": "Malware payload (AgentTesla)", "value": "c5ac5b406f4b1c7987a36e925a4bc0ba7d54b09e59c1f58c4159a07348843731", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868249, "uuid": "f53a745c-2bba-4b17-9c28-8746ca24d78b", "comment": "Malware payload (AgentTesla)", "value": "4d93049fed5eac8c2a0b0a235296b3ede9e0dc39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675868249, "uuid": "460a7a4c-f991-40bc-b4e6-83a93217a05a", "comment": "Malware payload (AgentTesla)", "value": "d7c0c3bc9b11270341e24fea2be6a822688c2f76e15626a3520fee2fea15f09038d013fa9e05a835e40adab895067d7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868249, "uuid": "ff513a69-c2bd-41eb-aaf9-394f9b9e454d", "value": "T16405220C5BFCAB22EA2D5BFE24B04870077AA8167113E72E1DC1B1DE3D9B7914851B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868249, "uuid": "1ab1bbec-2dff-48cc-a1e9-034d6d308b39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868249, "uuid": "802bf755-5a23-4289-be11-d111bb64cafc", "value": "12288:jxZ5ifzlf/sIkeXi5bSolILAuUCbhyYckVUmhFsyQ0uQmjPaq2fUAawHRr/CB06f:jN2SJb3EhyXsUmhO0VmDoUAawxO5dIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675868249, "uuid": "3aa97aef-519d-4132-a4b2-6724352a21d4", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675868249, "uuid": "ba0860a0-f765-48c3-96d2-ed5e807e65c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675868249, "uuid": "4a331cd2-97b0-4c40-950f-7aaf4b70306c", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9aeb6e-a77d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675839481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839481, "uuid": "ac5e2f0b-c4d2-4139-ba47-cca90b73f1e3", "comment": "Malware payload (Amadey)", "value": "90811453a73c659327bbbeba91cf5465", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839481, "uuid": "18831b88-eba1-47f6-9f4b-fb2734e52ffb", "comment": "Malware payload (Amadey)", "value": "c5c236448dfb8a61b9c66c8621f2539935c79f94aea63aa9b1389dc85bef5cfc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839481, "uuid": "4ed73a10-20b6-4992-b741-67af3a0d3261", "comment": "Malware payload (Amadey)", "value": "ea4c92cd00b6a85205a242c54878dd972d40a799", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675839481, "uuid": "61cf8412-ad94-4487-9705-0d4e58ee454d", "comment": "Malware payload (Amadey)", "value": "79361a57fc5fcb4a7c226ee34a6215c27990be2cda60c4d2be36b2b94f2095cdfde134279b44dd73374c6d0786f4fd12", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839481, "uuid": "b10b9352-1d8e-4311-981c-113dbc9a3a6d", "value": "T105C41203F7EC9072E865177029FB03C317357E709B3D466B264A6CAE09B22B4563676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839481, "uuid": "7ff8d7e1-8b8a-403d-922e-ca6948fa0c92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839481, "uuid": "09f1cb51-2c2c-47ee-85e1-776ec9255cd8", "value": "12288:iMrYy90N+JHrT2g0GKUTYi8gGfLePVMwd3xZo29HypsCtOl:Sy31h0GKuYiGCP5blypsCt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675839481, "uuid": "54aa6679-b687-4d8f-846f-be08752174fb", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675839481, "uuid": "3b3a0599-faeb-42a0-a15f-1258567610c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675839481, "uuid": "6850d3ed-cf82-4d89-8e19-f572b2bd4070", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b13679-a7ee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675887684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887684, "uuid": "a4d5231d-f42d-461f-9556-9b0975f048ed", "comment": "Malware payload", "value": "0f341d57ee5a314b378a315026eb65fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887684, "uuid": "24856eaf-9a6b-48dd-86ae-d349682ddf34", "comment": "Malware payload", "value": "c63db8fe5fba48f23f316675dd55e54478f619759bb54307c7fc3bc779f12ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887684, "uuid": "e05f9ded-eccb-416f-8bb9-4e2c4e022a9d", "comment": "Malware payload", "value": "d86825c2309b13e729a564cd915287424aad4730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675887684, "uuid": "e0d9b8cd-9399-46bc-b00f-900fde6729c0", "comment": "Malware payload", "value": "e101b4439490bd621f5eeaff567380ddbe6ef651220dd33561e6462c8e585363130b724f0d9c31bc2056b59a5add6285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887684, "uuid": "a1946439-f73c-4385-9e58-ab334460c1e1", "value": "T11A640803D2E17C80F9658B76DE1FFBF8765DF5A08E5AA7663218DA2B14F0172C263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887684, "uuid": "8bc22017-b6f6-4d91-ab94-4dbd9cce212e", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887684, "uuid": "fda9bf37-8f84-4a49-bea1-76232101bebe", "value": "6144:o575sJt4OGVna9zMy83uyNPyCjElLiq26vJ:oda/4LVQMLpeF4KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675887684, "uuid": "0e42acb1-11b6-4813-8c71-4f0d80c1498e", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675887684, "uuid": "e049bf0a-69dd-4a87-9238-79452d75f1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675887684, "uuid": "de5baa09-c846-4393-9209-2d8a845331a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b28db7e-a765-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675828820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828820, "uuid": "4c165354-b374-4651-bdc0-d51c2b2f8ea9", "comment": "Malware payload (RedLineStealer)", "value": "19cfdc8b89749f0201fe1b75b08e62af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828820, "uuid": "b7245751-e659-426b-9b57-94acfc2d5bb0", "comment": "Malware payload (RedLineStealer)", "value": "c656f5bcd528544b2afd6eaa6826c7d2761daf6ab11c6f18827a8130ad643b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828820, "uuid": "7f20bdec-e724-4d70-9068-4b3994188521", "comment": "Malware payload (RedLineStealer)", "value": "3b9cb2a51eeb9b1aab443782e9ba4cf6dcd3ee99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675828820, "uuid": "74ff5cbb-eb35-4e56-8e8f-68492cd53791", "comment": "Malware payload (RedLineStealer)", "value": "963c45a2ad7e93a5825cc60fa2d7a46c7301e5d17ffc8f52d139e77cf4e290afc735cd0ff18900dfec479e8e1b0d11f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828820, "uuid": "de5053cb-e60c-49b4-b000-be749a56393b", "value": "T16E64F1213790D0B2C92A54308C60DB616BBEF83156BAD56BF7A817ED4F306D1DB3A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828820, "uuid": "4c448031-302f-43db-88f1-36a77944ebed", "value": "9e2bec029acc4e0e56da5de850931a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828820, "uuid": "048b5635-3035-43fc-a5a4-5014968fee6f", "value": "6144:rfIQZILjtE/6a8ROtdX5iunxbEv2cnd5U:rfIQZIXtUWRkxVEv2sd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675828820, "uuid": "dd3ba63b-77df-4bf3-8fea-cb20647e0212", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675828820, "uuid": "801e4f82-33e0-4979-b791-22a5bf5470dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675828820, "uuid": "b9d3fea8-a433-4df8-a253-add8bd572f3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b96b25-a776-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675836104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836104, "uuid": "f52ffed5-8fb6-4666-9dad-8ae8eea10104", "comment": "Malware payload (RedLineStealer)", "value": "c76db2c587db86059fc6e1d60cb7adf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836104, "uuid": "0fda3849-4164-4e58-b7e6-9fa77543d12c", "comment": "Malware payload (RedLineStealer)", "value": "c66a85851530c3ecc0587a89b0c2320964495d2324187cf9743d8fdfecd82f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836104, "uuid": "06775d06-5985-4b09-8217-e12c16e8fbe8", "comment": "Malware payload (RedLineStealer)", "value": "f8faa72ebd82e26dafa462d38916fd24a692d337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675836104, "uuid": "b71c0648-ec9a-43b3-ac71-aa659fdfbc59", "comment": "Malware payload (RedLineStealer)", "value": "a97e82922149c21aceecc91828e4a6a2dc6c1557676bc31ce8d4bdd842db4375a3d94ac9428219abd531d22f1d7b359c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836104, "uuid": "23504917-aa20-420a-b769-5e1a1ed9704a", "value": "T185948D5392D17C48DD258B73EE1EC6E8FA0DF690FE4B77693218AA5F18B0072E563211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836104, "uuid": "906d3493-ae23-4138-9b7c-d92212d94bf8", "value": "f24c70adc5293af8000f2c39db7b30c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836104, "uuid": "961b163f-0a15-4ab5-95a5-fbc5fd077c18", "value": "6144:EHCVBUbdf7+MO9sUscx15O6yfSnXtjI3HDLhwSCAS7m6ekWUj9UIu:EiL8fnanXtsXDWSCASxekxZUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675836104, "uuid": "327caf35-5b05-4096-8e8e-c20a4afee25b", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675836104, "uuid": "ff1c5104-d648-4d01-9617-dd897e86ceb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675836104, "uuid": "41f164e4-4821-41e5-8cf2-79eb6090eb6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0093f24d-a74e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675818897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818897, "uuid": "4b11d5ec-6380-4ff7-ab0e-299ab9666b30", "comment": "Malware payload (AgentTesla)", "value": "edf2482324868bd3843ba4e73258493c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818897, "uuid": "22581fea-2c5c-41b7-9b4c-de6284ac5059", "comment": "Malware payload (AgentTesla)", "value": "c6eeabef48a629434a613caade883ec827de3e2061750bbd807df2a3e5c19809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818897, "uuid": "f7cab21f-7d24-4512-88b3-4efd21f819af", "comment": "Malware payload (AgentTesla)", "value": "63ea0ccb381e1e765ed550c7b39b577f64c5bc48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675818897, "uuid": "97e2193a-8933-4e4a-838c-0deb68fab269", "comment": "Malware payload (AgentTesla)", "value": "8cf6fd5492e6e564807917f4039c5942c5aabde8c5d4c99bbba028cea7328351e95677f5ac7a4c15d695ff43b6557811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818897, "uuid": "7620a2c1-8e3e-4c74-a003-bc9cc09c60e8", "value": "T111942238B650C49FC8F507715DB29B267E68A4230578576F63683B8E7A32390DE0E793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818897, "uuid": "263b4249-fe3e-4647-9384-08329c5805bf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818897, "uuid": "68c4d4da-f3c4-4ecf-bb52-f2da1191fff2", "value": "12288:LYemnabRqoBtSHZp+sv+BW7jyPtdsPGZRae:LYemazSHBqP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675818897, "uuid": "e120da46-319f-4965-b08c-c21d2db2df9d", "value": 410569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675818897, "uuid": "9f93e768-921a-4868-b698-7084ff431473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675818897, "uuid": "5d563307-7493-4318-a804-8cd647dc131b", "value": "edf2482324868bd3843ba4e73258493c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e438dee-a7b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675862434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862434, "uuid": "4257691a-dca3-47cd-97f6-73e19a092210", "comment": "Malware payload (Amadey)", "value": "92678a4e8eda5dad0096146d690af9b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862434, "uuid": "e9172c93-dd03-4506-b52b-9a8b3db000a2", "comment": "Malware payload (Amadey)", "value": "c6fc18502f26e79ad7e69efe93d70ff92cd752a12371a30768625fe793904736", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862434, "uuid": "9ba92c3c-379d-436c-996b-478d5d1c981e", "comment": "Malware payload (Amadey)", "value": "99bf9e7249501be56ecacdac1183f9b638419084", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675862434, "uuid": "834fa7c3-3b27-48a8-86db-468934f8787f", "comment": "Malware payload (Amadey)", "value": "ff021e0df2ea6baf0d114187223733fded09eae51fea99e53daaba0f5dcf305834c1d6777ae7925149383cb54ebdc37d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862434, "uuid": "3cb48c8d-4a83-40e2-a81f-b9526129940e", "value": "T18FC40257F6E84032E9F9573098FA03D30A36BE911B78938B670E6C5928315B4E23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862434, "uuid": "7b2c494f-0211-4314-9dcb-272b712b7412", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862434, "uuid": "53f17477-60f5-4f52-942e-4c10c755b9bd", "value": "12288:fMrgy908hLS7RA7o5N64GEarSa40mvMGwnonWXdn:byY7eo5N6Gda40mv/8onWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675862434, "uuid": "bd5982e2-8c92-4ac2-b98b-6120561ec086", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675862434, "uuid": "74db0872-0ba0-461c-81be-64535f0ceb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675862434, "uuid": "4c0ede69-6277-441f-a409-fbec7a5ae2ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73939ae3-a77a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675837988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837988, "uuid": "1c60ae64-2a4b-48ea-a619-39b03f61fb7e", "comment": "Malware payload (SnakeKeylogger)", "value": "f5587264e8f09a08d2da8fafc8e4018d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837988, "uuid": "ee6abbc4-554b-4680-ab87-ea4b08270d5b", "comment": "Malware payload (SnakeKeylogger)", "value": "c70e72234a87de5e498b593e5912c26b5a64631f0ffde77c31dfbf0bca91ffbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837988, "uuid": "926ee773-b604-4612-af69-2c82b742bb23", "comment": "Malware payload (SnakeKeylogger)", "value": "8977516516dee53887be48e39b028b9bcc895d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675837988, "uuid": "8b893d6f-bc9d-468b-b380-f495a86ea4dd", "comment": "Malware payload (SnakeKeylogger)", "value": "9934be637fcb01a0a0f0c17d4f8e174e075db9fa0ab86efaca53e3a1432107ce01cd9a2b334e2ecb983aace8ac35c015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837988, "uuid": "28b7e4b7-6065-4c9d-a41e-3c112132d91c", "value": "T1F5B47E3D1D7716E2E1B8FA7196E28420B5AC8183330FC95AD9DADBC07F016826DCE65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837988, "uuid": "664060a1-4c33-4f3c-bd85-33dd53ae8b7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837988, "uuid": "53b493d0-f512-44d1-be37-d68597d89987", "value": "12288:IV+Pb+HT0qE8S6S7ztLHKNu+A+/1b1F2hpR4XOw4QNm5hS:IV+b8vOztLHKNu+A+/1bP2DR4aQOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675837988, "uuid": "957f70f8-2826-4616-a44a-fbe86761612e", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675837988, "uuid": "6daeb36a-80c9-489f-b6c9-4e3fce04fd5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675837988, "uuid": "f97dc9cc-5554-4ca0-87b6-1681a8b1ddc8", "value": "SecuriteInfo.com.Win32.PWSX-gen.29739.15259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a0984a-a7a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1675854262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854262, "uuid": "20ad0d55-b88c-4513-a153-4f4ebc96d33c", "comment": "Malware payload (Downloader.Upatre)", "value": "04ef92720068a3e97f1b7f8f4563b26c", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854262, "uuid": "08d09cb6-c01b-4c72-a29c-42db1cb0c3a4", "comment": "Malware payload (Downloader.Upatre)", "value": "c7a361aa2caff791d756bc87fcd253259f9a89e2201cffe74777e0d4a59fbf86", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854262, "uuid": "4c10c2e6-4bf1-4980-b73c-c9accd3bcafc", "comment": "Malware payload (Downloader.Upatre)", "value": "33c25fc79afce9dce652ee091e75a30a7f81377d", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854262, "uuid": "25ca69b4-8dfb-4ab2-b24c-4850db0b646d", "comment": "Malware payload (Downloader.Upatre)", "value": "20326a59dc8876d76c396a7457d4e402046b0651717ec9682bef5efc15b0f389b33188f7b8066bd49e92f2279ae6eb9b", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854262, "uuid": "7b73a8cb-fa5f-45e8-b5eb-7604b0022bcd", "value": "T1C0F23CA56BC18022C3265F31DAF397C5E7BC7C2336018A3F6A557AC81EB374A799141E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854262, "uuid": "9f431d4f-4da0-4fd6-bc0e-0e8529f2ae24", "value": "d96606024a9ef84869c5d61c686ef019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854262, "uuid": "407a4784-ccad-4a11-8d59-8d9feb6d2240", "value": "192:h1d1oZrmQ6PDlSnx02Vupd5hcydQgg4NS7mIBniV9M4uPIulkgBQxouj1:h1dyZAPDMnx0sOdZdtADaM4E7FBolj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854262, "uuid": "0f353faa-2a5a-40a2-971a-f1163847fda0", "value": 34368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854262, "uuid": "8c5d89d2-821b-4a90-84d3-1c8520f426bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854262, "uuid": "e0a998cc-b458-4228-b88f-208e5f695e8c", "value": "c7a361aa2caff791d756bc87fcd253259f9a89e2201cffe74777e0d4a59fbf86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6046800-a7ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675859601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859601, "uuid": "4969d166-f1ca-4537-a25f-7190b467c9dd", "comment": "Malware payload (Smoke Loader)", "value": "5fdb0377b56ca654b1267a57a68144a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859601, "uuid": "4c2e28e0-7465-4d0b-9650-9754e775995a", "comment": "Malware payload (Smoke Loader)", "value": "c7a7edcb38bbf0996d90eed750aa01a9230bddfb1dff2d64986d3f412879581e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859601, "uuid": "976d36b6-3823-4e5f-9f26-a46d0b6b51b6", "comment": "Malware payload (Smoke Loader)", "value": "41a2c773ca056334c3e68aac6af1cd7216bbcc3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675859601, "uuid": "c6ffd34d-a837-49fe-9b4b-dc34fcca6709", "comment": "Malware payload (Smoke Loader)", "value": "bf3995cf8ca7c8836a43205ed5c265b283fce75b78483f617aec18cfb9485bf26aff6a1379b75f6f86027916c6da1507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859601, "uuid": "6449db65-f604-4fb0-b3b8-82478a89cb6b", "value": "T16B644B9393D17C4AE926CB77DE1EC6F8F60DF591EE0A37693218AA1F1870072C563612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859601, "uuid": "4bae10c3-5705-4602-badc-ee9cd268a4d1", "value": "44724d6c2abffef4f6a69c1f8fdec6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859601, "uuid": "44f8906b-8a9c-4247-a15a-d0b32f582b5e", "value": "3072:zwAqf7GtRl6ZbXWcnOp1FcLtxmhZbXBchQK7uCDEjHSOWByUAl1gm2bBWnU:zJyQ6ZbGcnMELOp8BDuHXWUjd2bIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675859601, "uuid": "2652b672-874b-4585-9b83-f8e36a04743b", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675859601, "uuid": "35ac664c-b395-4fec-9418-31d31b3ecf07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675859601, "uuid": "5f5e53cd-3e14-4007-b94e-6146c3e6d6c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4794752d-a7dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675880434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880434, "uuid": "e1b70b63-7466-4828-a99b-b87ceb3567f0", "comment": "Malware payload (RemcosRAT)", "value": "f92ebc5dca13934c2bff50fe8036f41d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880434, "uuid": "33759c3a-2e29-48d8-827b-e7904f339081", "comment": "Malware payload (RemcosRAT)", "value": "c7e2ce7b8a6da88127cbb0730c2b8b9869f7f0e6a4ba831e34d1aa18122ce5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880434, "uuid": "4ffbb690-a39f-484b-b94d-49eb5e638a3c", "comment": "Malware payload (RemcosRAT)", "value": "b00736f14237682249bf28239ec1f6be55fa1b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675880434, "uuid": "948f8c04-9592-4eeb-807f-f1bf9a450809", "comment": "Malware payload (RemcosRAT)", "value": "64ed89223a7dacb5d87c4844e6630a6ca0cf0ac4e620a8375d9a95f4c5fd742f261e2fd27dd78703908343159dd6eddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880434, "uuid": "cb979839-5ad6-4bf2-a6a0-3032f0d14429", "value": "T178B423107EB6DA8BC49642367CAE8F254FA74D1C0592920F37052F18BF7A24BDE4D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880434, "uuid": "84306005-a240-4874-800c-7e7a4c9cf4f7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880434, "uuid": "8574fbce-57e0-4b9f-8818-f1c4c9097b3d", "value": "12288:7Y7K5STwrqG12X2+aZONvVjeuBukSkDZUBrzK:7Y73wWe2XaENvxPlUtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675880434, "uuid": "9a734aa3-6e6d-4627-bb8d-df6db15fcf2e", "value": 524448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675880434, "uuid": "39326472-66c2-4d33-97bb-954acd14a557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675880434, "uuid": "141c54f9-ba1a-4995-80d0-f1ea0c1a8780", "value": "Draft Contract.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d532e0f-a7a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1675854352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854352, "uuid": "d653a292-aec0-49f8-ad98-e92be917d9d3", "comment": "Malware payload (Downloader.Upatre)", "value": "1bb0a0d1a0b06888292527a5e12614f6", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854352, "uuid": "18bacea1-80c9-457a-95ed-66a601030f52", "comment": "Malware payload (Downloader.Upatre)", "value": "c7f211a8af95946ccb447d094fd86bf1c8158513a56407b67365032f8f685720", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854352, "uuid": "258a77a0-5fd1-46b2-af28-20e76997da98", "comment": "Malware payload (Downloader.Upatre)", "value": "62874833ca1f8184b53baf4fb9b09312d08695fe", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675854352, "uuid": "f0ebdb31-cdd3-4dc2-8079-6cc772e8f356", "comment": "Malware payload (Downloader.Upatre)", "value": "5d67b25b2ec07a260958a6d1a9be6b579ad415d9451a71f1d8cd99d207947fbc58be87e80fb1cc46fbf6826615ab9b43", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854352, "uuid": "290a2a3f-b1f6-4e6e-a439-1a5c60d0deaa", "value": "T1C5D2DC742BEA5A72F3BFCFB986F591C5A934B4223E06984D501947840823EE5DDB0F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854352, "uuid": "7d847288-9369-4c2f-8c47-83cea251508d", "value": "365f29942e5edb954b5404eb9cdf9cb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854352, "uuid": "fb4974f5-eda9-4b1f-8b40-abade14ca413", "value": "384:NzSzwwluusdcPXSR5tNXLH8dj7ecw5MHXuuX:Y8wlds8q7xc57ecnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675854352, "uuid": "42bb8084-252a-4043-b1b4-4ed2b575cbd1", "value": 30336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675854352, "uuid": "0113982b-adec-4bb6-93da-cd0ec6f42814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675854352, "uuid": "9f551da1-cba1-4e27-b449-901418e43147", "value": "c7f211a8af95946ccb447d094fd86bf1c8158513a56407b67365032f8f685720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c75ed6-a78b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675845454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845454, "uuid": "ec945b7d-4159-4aef-9ef0-5518191bd27e", "comment": "Malware payload (AgentTesla)", "value": "dd80116107948b21cd05010aec0349e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845454, "uuid": "bca31020-606b-4fe2-82ff-07f0125801c2", "comment": "Malware payload (AgentTesla)", "value": "c812c24d7a79a942f76236f5eba64c484de8a55d91f9dee7396f18a5bf95c5e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845454, "uuid": "27c81c86-1b81-4b62-a64e-b69dbcd14ef4", "comment": "Malware payload (AgentTesla)", "value": "eee69181c1f472a3c8dc8ab6cd61fa48a07a9e78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675845454, "uuid": "b79d6dfc-0349-4f0a-bfe3-bcf21db6026c", "comment": "Malware payload (AgentTesla)", "value": "51f89a169f2ce611be928f2ce7fba8894eec98035737ff0956cd94e521442fe1804c454ee74e46e6931dcbdd1c31f196", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845454, "uuid": "c24e2994-c76e-41c2-82be-68bbbfffc877", "value": "T127F4293E69BB56E2C578F93982E18520B5AD93833303DA59DDE66BC0CF012867DCE15C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845454, "uuid": "1b24ea0f-4d03-4943-b25c-9889a57326a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845454, "uuid": "847b90cc-98fc-49a1-9fe7-a5670aa1f4b3", "value": "12288:rVeqshUgUDne7f4WYMTyPdLX2tuCAe/ZX01Uu5eABI1pcOH2pX8g28rSwECvmhGn:pGI7MTyPdLX2tuCAe/ZX9JH2pTS9Cvqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675845454, "uuid": "9b55e802-ff6e-4604-a1ae-c1271374aa20", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675845454, "uuid": "a7a76d46-e1d2-41e0-98ac-71bf2061fc41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675845454, "uuid": "fdf429d1-ff16-4979-8430-9b41e8f5997d", "value": "PI 20484-234 Qinum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942c02c4-a7e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675882281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882281, "uuid": "19b926c9-7943-425e-baf7-41d18b2daa83", "comment": "Malware payload (RecordBreaker)", "value": "6a061d5ee4fb20c05884ff2b369ddb2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882281, "uuid": "d015f351-f2c6-46a7-83d5-2b427ad13abe", "comment": "Malware payload (RecordBreaker)", "value": "c81897d050c7ba737b4e0a1e48a4c2513557521720a55d2be0d63ed3df0b22ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882281, "uuid": "5f0acd18-168f-485e-a55d-46cee9a98572", "comment": "Malware payload (RecordBreaker)", "value": "bcf7a3fe369c693a09be9e2dc1c713e13f26f133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675882281, "uuid": "f40cc7bf-52e1-416c-b927-0fb128e99cfc", "comment": "Malware payload (RecordBreaker)", "value": "23cef88a05eb5fc2b9c9ee5e729189e8b79089c2feb2d1e7deeefb686ab3dff216ebd4aae352075eeae84f846e6d656c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882281, "uuid": "242a2479-ad19-4a14-9844-1cdab79c7a18", "value": "T13B641903D2E27C80F9658B7A9E1FFBE8765DF5608E4AB7763218DE1B14B0072C163625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882281, "uuid": "c3bec346-8147-40e9-bd04-7805de48b6cd", "value": "37437fdf2f996efc4629f1b4dd7357e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882281, "uuid": "2222e4cf-98a5-4acb-9dc0-026445225ced", "value": "3072:iPgUSd+kdxR90s2L7xZCcBK35LOlerLAgsqsgZAsWQDiuLpK8mgv:ibSTrf2L7n5k3NOlzO/LiqKgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675882281, "uuid": "040e1432-f7ed-4e23-bbae-2eae68f9dd42", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675882281, "uuid": "0592e859-224e-4a6a-ac18-c53ec823afde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675882281, "uuid": "353a0618-7aa0-45f3-a6de-00eff00808d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ef0a56-a7b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675861217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861217, "uuid": "d6d9e2b6-e840-4c97-a180-1f068c30706c", "comment": "Malware payload (Tofsee)", "value": "78cc2004a61a5f5bd968bc7449a6e41d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861217, "uuid": "932c01ea-1be7-4eff-926c-2ef84e161f2c", "comment": "Malware payload (Tofsee)", "value": "c82a55fdd3caeb95db17754e3ba270ec93a7eb3c9997f9f9c6f02de0e17bacec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861217, "uuid": "58e56506-08ac-466a-9680-cbb2d43f4b3f", "comment": "Malware payload (Tofsee)", "value": "5d68410afdd470c5d076b6de46c3b2eeee953be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675861217, "uuid": "7d682c65-2716-4436-8042-6eda965e50ca", "comment": "Malware payload (Tofsee)", "value": "c0120b1b998c7ab4fac09427cc634b18cc07737972e493d0532d383b5a95cb66e3391319a6392bd79d6b3e9ac9c8aff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861217, "uuid": "3202b4e9-4e84-46f3-a057-16e6fbf7f90f", "value": "T1447533427CEA01BBEC71C5B09B1E03926A6E6DF1512A135F63A11F18B9736A0D207F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861217, "uuid": "da1d6aea-781e-412f-bfe9-ed5b19ad9e30", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861217, "uuid": "e92546dd-1486-4a56-81e8-ac1074d46cdc", "value": "49152:EgSqM6bpcBJT+tFgYlGiFKtFHbo1kEJwQ/oW1vAaK:Jq7v7FdEJw8oaoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675861217, "uuid": "0970d0eb-1ce0-48f7-86c1-b392a1faa080", "value": 1577875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675861217, "uuid": "a0b75ccf-5644-4e99-96fa-f2eefde1d01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675861217, "uuid": "99b736dc-f4e5-4e71-94bd-d1b39b28c929", "value": "HEUR-Trojan.Win32.Chapak.gen-c82a55fdd3caeb95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7756a24-a77c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675838988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838988, "uuid": "a38d00e3-72f7-43fe-b0b8-6ee55cb71a78", "comment": "Malware payload (RedLineStealer)", "value": "120ee18af12c51eb9604b2b876297e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838988, "uuid": "db13d4d3-7c47-4359-a232-34845b8f89bd", "comment": "Malware payload (RedLineStealer)", "value": "c84e2e9068b7398fc7f5611a6ba76aa8c613c6ea8c070d0bc97abd5f5efe2e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838988, "uuid": "999faf44-d381-4f41-85b7-c5d614ec648e", "comment": "Malware payload (RedLineStealer)", "value": "4b45aacefe3961f7ab3095d3480f2b544aaa8651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675838988, "uuid": "deb65b49-d46a-4e9f-bbae-a5d4559719ed", "comment": "Malware payload (RedLineStealer)", "value": "69acadb8216642957e3b7ad561c8a4df1706775bb925dbd328248523efaaef8ee8e02670f1e375c5f41075cfd2780945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838988, "uuid": "6db2586c-b648-423a-a5d3-326a32eea7cf", "value": "T193C4021BB6E89072ECB023B419F605C31536BD615B38936B238FAD5E1C336A5A5307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838988, "uuid": "e8bb4b0e-2dc0-432b-b2f5-74c645e5a065", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838988, "uuid": "e0d07ca7-5cf9-4b15-84c9-d27452c892c1", "value": "12288:NMr7y90uMPai0f0XYFjMcHuv+JvopkZOXXiASbc:6yVMyi0f0Ypi+1sSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675838988, "uuid": "0bf2189b-2403-4a6d-a5b5-20414495f638", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675838988, "uuid": "9d1ba5ac-1cc1-4726-8368-d64a48c23567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675838988, "uuid": "436c8903-74f0-4507-9261-697605c1d26d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173176c4-a748-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675816358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816358, "uuid": "2e65262a-d857-4bdd-b7fa-1ab356c544c6", "comment": "Malware payload (Amadey)", "value": "de66d5465b9ae9a4e22d35a82a96969d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816358, "uuid": "40f5584a-9567-47e2-acc7-ee8e8ee80d04", "comment": "Malware payload (Amadey)", "value": "c86937fc8bb324f83b154060492f050910239f0f244e3f9b0662cbf632bf9465", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816358, "uuid": "7a557024-0e54-45c7-bafc-cd2deb24ef7e", "comment": "Malware payload (Amadey)", "value": "f5208aff88de2faea3f7ee79ab9b5e7072d0de90", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675816358, "uuid": "08685f20-c5af-4e33-8e84-1eb919efc9a6", "comment": "Malware payload (Amadey)", "value": "3e75a1b94d49f427ceade2e797b080c5c13e859cf68d19878ab6e90959fdb5a156056bd2d9c194256b14f2552d93091f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816358, "uuid": "d47e9194-c9a5-4d34-9907-aa9ae1640eb9", "value": "T129B4020BA7E85433E8F1577029F602C30A39BDA15738864B274FAD1A1C736A0B67577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816358, "uuid": "afaa7547-f229-4a06-a85c-8f542908f8dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816358, "uuid": "720c900d-b129-406b-87cb-6b3b2f137118", "value": "12288:bMrhy905yYKa/soWDx2UkPR527Jdd6cXWtrEudxP7uNhDhXL:Cy33XjDjkPL89PXWtrEoGd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675816358, "uuid": "4a0476d5-2f79-4e78-87e1-6c0374c8c34f", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675816358, "uuid": "d628e77e-8504-46f7-9278-bd76c4dcde29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675816358, "uuid": "c678f91d-7500-47dd-990c-112f973b7d81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488ed2d9-a76c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675831903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831903, "uuid": "3b7d8c18-485d-43d5-9ddd-fc9c20cc5a3f", "comment": "Malware payload (Amadey)", "value": "324b6788b5c1414169ca45ec88b2e15f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831903, "uuid": "bf1e0bb9-7020-45a5-89cc-da10df762084", "comment": "Malware payload (Amadey)", "value": "c9f7de3d86c2bf78552513a6da7581196d18da8db607aaed46ba7d2f7291b339", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831903, "uuid": "e56a951d-94ed-40d3-9181-456068ad0a0b", "comment": "Malware payload (Amadey)", "value": "14e101565f34bbd12e27c067b61d8306e39c949b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675831903, "uuid": "36ad0529-d871-4ea1-932a-0b99d20bb4c5", "comment": "Malware payload (Amadey)", "value": "578442ad70796b3bbc8466ef247a4967161c15a11ca66165ba151e4c4145763ff120f93b20a1eec9deb38bbad5ed749a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831903, "uuid": "27e7dd59-fd6a-4e2d-81ba-510c61278ce5", "value": "T1E6B40207F7FC9032E9B1977409F702D30A357D626A74C69A628F6C5A1832A74B53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831903, "uuid": "12398c96-3029-4e2a-88ff-825b4db8d979", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831903, "uuid": "88080989-3770-47a2-ab30-7d714345860e", "value": "12288:jMrby90ysmSVH2Sh5VMfLn/9r14f7o1yTQL0H1hh5:gywVFxMfLnlU7o1eQLG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675831903, "uuid": "760c179b-17dc-4f64-8f99-509da6b067e9", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675831903, "uuid": "9a301367-60da-4ca0-b33e-39f5c331fcec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675831903, "uuid": "13861ffe-dbf6-4596-8667-ccd268c89924", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b442a4b4-a7df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675881476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881476, "uuid": "f91570e1-a8ee-40d8-b050-2e4e1d63fbbe", "comment": "Malware payload", "value": "ab4c754c479710a8ff49860d27119247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881476, "uuid": "4dd29a92-3efa-43a4-a7ac-280b7cc27803", "comment": "Malware payload", "value": "ca3a157123bb2200fe8762064d747bd119ab25a6be363efed03f7a652b1002d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881476, "uuid": "c0f8b4e6-9836-4fbb-b83a-a3f46f571a66", "comment": "Malware payload", "value": "90127327ad28a37d5dd425d99b63b52990456a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675881476, "uuid": "37f8f61a-5cfb-4c2b-a994-28effcb74a07", "comment": "Malware payload", "value": "1ba9af56b87ee3582b38e909e2735c07e70dc0a0952eeec01632427cd85555e0bc3bd2d8810509fd01fa3fc6431bb716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881476, "uuid": "0190dd4d-c9f9-4fe5-973f-3ac9af9fa6e0", "value": "T14FB518B494BB45DAE40FC9801ABCFDE5127672F3DCE20CB5036DB6045F2BEA86E0551A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881476, "uuid": "b34a6f00-9412-48da-bf44-b66ae22c54c1", "value": "24576:0vikWW0GqXl2hEHzyHZU/nw4Et6gFhnX8:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675881476, "uuid": "ba259a6e-48b5-4863-944f-208ee23ef1a3", "value": 2465280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675881476, "uuid": "9916d1d3-0ec0-45ce-bde0-54f34658c69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675881476, "uuid": "5b2e397a-0065-40dc-84bf-db282093e43a", "value": "HSBC Advice Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33c3ab4-a800-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675895728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895728, "uuid": "9b403235-4083-4d70-b790-3a12e791c8af", "comment": "Malware payload (njrat)", "value": "04b38feaaa4a1f9418a704d6f08ffa78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895728, "uuid": "a519f864-54ba-434f-84fe-61628378967e", "comment": "Malware payload (njrat)", "value": "ca54f1525a6b447190d59b79e65f1841f752849d45bd3cb57b033055d054728c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895728, "uuid": "f13f6358-d723-402d-9b40-bff41b45f9c9", "comment": "Malware payload (njrat)", "value": "98f6c18c403e2663ef1d9682f298fb3a96f31cff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675895728, "uuid": "066e926d-a0dd-4e0f-af68-a45e8ca67c01", "comment": "Malware payload (njrat)", "value": "26e0b58beed2143e37282a69bc2fc082e4fdc037bcdd37229baa3adb14e399657588c9d76975835ea8b28dd1ddbd1f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895728, "uuid": "1dfd99c9-4f1d-4e87-97e2-e73d4a9481b4", "value": "T17393E84977E56524E1BF5AF39471F2404E34B44B1602E39D49F219AA0B33AC48F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895728, "uuid": "b8264c8f-0843-4915-8a5b-0731f24ac13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895728, "uuid": "c1abba7b-4ead-48e2-aa7d-f79f69c5bdc2", "value": "1536:+eQYW6qbkW8aVpO1XRkoojEwzGi1dDVDOgS:+eE8aVpOxSCi1dZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675895728, "uuid": "6a4ddee9-8118-4a2c-92ac-78c0abae2780", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675895728, "uuid": "1a141ff4-03e0-4373-8f62-c958fe04c47f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675895728, "uuid": "0ce657ad-c830-48e8-a001-3629f4884182", "value": "04b38feaaa4a1f9418a704d6f08ffa78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a641c257-a7ea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675886177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886177, "uuid": "e40ec1c4-4dc9-4928-8894-fcd8819e31b3", "comment": "Malware payload", "value": "80453b50a4bb28cd82be6253ff3e4542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886177, "uuid": "11009c64-3c9a-4676-9acf-64a8c85cd318", "comment": "Malware payload", "value": "ca65ce40f7a84bd1659f5258dc6ea11085da9d012ffafbbe8146384c5ca44454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886177, "uuid": "6bab96f5-1718-417d-9dbf-e0b308b8ba93", "comment": "Malware payload", "value": "afb652612c2a12b2e9c4c6331ae087a9a6f8553a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675886177, "uuid": "7de9d74b-6f4b-4aa7-864e-d73e103054b3", "comment": "Malware payload", "value": "26dbc5cefc6be88681199a43ac8e86cbacfde4ead207d9f372d77d618982e2222e62ebb735aa3e85faa126da99f5d582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886177, "uuid": "0b50a7c7-8422-4307-828d-f33f81fc39eb", "value": "T11052F96062EC5423F8BE5FB98DFA5101437CB6E3B812DB6F15C8518EAAC27414991B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886177, "uuid": "093cb92d-0270-441d-b241-e771e8d90548", "value": "384:kYVYVMI9/FyNIbE3dYQ9PmzZKN6wzbaZv:rYVt9/AI+9Pmz06SbSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675886177, "uuid": "c52305d8-634b-4456-9d2a-2a63789221dd", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675886177, "uuid": "98872f29-02aa-469b-8cd4-24453f5d410a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675886177, "uuid": "e7d8d609-ee4d-487a-a053-ae7f0154b33a", "value": "80453b50a4bb28cd82be6253ff3e4542", "object_relation": "filename" }