{ "Event": { "published": true, "date": "2022-08-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-08-03", "timestamp": 1659571381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "22e35d5f-1106-493d-b5ea-38a53c26f3d5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db3b792-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659511841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511841, "uuid": "93e7607d-6dcd-4ebf-b101-cb6d8a9bf724", "comment": "Malware payload (Loki)", "value": "133f99c9baf410b2d9eedbe795f0ade2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511841, "uuid": "f6c31b2d-8493-4e43-9686-4811c1f8c197", "comment": "Malware payload (Loki)", "value": "003e2a67c311447ad02b62b21d9c4fe239ebb60b0feb6bc581d25bff35c472c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511841, "uuid": "71844ad1-50e2-4847-aa8f-d0940aac53a3", "comment": "Malware payload (Loki)", "value": "96cbca32e385d8697232288faeaebe7eb1a5a28d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511841, "uuid": "129e0a30-c3f5-424b-ba81-6db0572bac20", "comment": "Malware payload (Loki)", "value": "0681cbb7f42617f7cd5c76efbaeafe8041cf7b05e5787bf49fcd987af3e04f36450ceb7c4026cd5fa515a96844bc0fe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511841, "uuid": "965bdf77-d586-4fd8-950e-daf400795f5d", "value": "T193F4F17F739BCF03C0259E7AE4C309940366D16F6633E356BCAD367A694336A8980785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511841, "uuid": "7dbc0694-08fe-43a6-a62c-facfb45e78a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511841, "uuid": "19c2c4ed-9d45-462b-998a-9dd764798e39", "value": "12288:GGVMzOzg6SKlpxLL69yn7cOERglPsRqwzn9cN6sCqUFjv8A8gjlI:DVMzOVLlpxLQyAesRjKcsCb58A3jlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511841, "uuid": "8ac35a6b-1218-41b6-ae60-3497b12bdf30", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511841, "uuid": "20ee0277-513d-4758-8eea-1f41d7dfc907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511841, "uuid": "8369e3f0-6e6a-49ad-8073-9ee27e91fb52", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b9d384-1330-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659533648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533648, "uuid": "72217b9e-c5fd-4b11-8c25-0e3b404e07f9", "comment": "Malware payload (AsyncRAT)", "value": "1e22c88831affccd123b47186b347ce2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533648, "uuid": "5f6fcb6a-4170-4320-8a7c-3a53ca8d09be", "comment": "Malware payload (AsyncRAT)", "value": "0097837fdfdba9b1e0a339b53940a728bd34545f62bd889555cf24000916b95a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533648, "uuid": "335f830a-99dd-4f9e-aaee-4ec512d54bac", "comment": "Malware payload (AsyncRAT)", "value": "be35af78f79a2539cb38d9aed3982cb5b51355ba", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533648, "uuid": "c7ff69bd-8d98-435b-9ac6-77cdaf5c0ced", "comment": "Malware payload (AsyncRAT)", "value": "eb4af20ed5e410e1d397cc4773925d23b35f58eb9cfdfc195e2933e7cd28da4f09f0145739cb575d7bd7bef42910a031", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533648, "uuid": "e2a076a3-52af-4311-86cb-b31236742fb1", "value": "T1CF158C2320FDA1D5F02D6E77878093645AB0AD42A235E153E95B3BC7C6F3963CD528E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533648, "uuid": "1f5a0d78-6741-491f-9cbd-3aa9dd1dbb24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533648, "uuid": "50e8c0a6-654a-47b9-9232-2ba7c3a0f386", "value": "12288:V0ukWmOhLuyAH+2iNy2TINY96QyKP0Ro1z:gUhLuyy+145STyKcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659533648, "uuid": "48b55342-099e-4896-81fa-de2d4181c2a4", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659533648, "uuid": "741b6817-aec2-401b-b6ce-4218a9c7dd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533648, "uuid": "cd07f5e8-b733-4814-b4f1-021cbcfe8210", "value": "Purchase Order No. 1221TVI-1943..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f531f0-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542675, "uuid": "bac9ac39-faf3-4fb3-b31b-46bf6046a595", "comment": "Malware payload (Mirai)", "value": "31d0d8345bb0a40887513f38bff3d425", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542675, "uuid": "70c2dd44-4bac-481b-ae8d-065800ca4fa9", "comment": "Malware payload (Mirai)", "value": "00a6e870fb67f8e524c60561df30ecb40372975a5b7f51015f084c73104477fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542675, "uuid": "b145db1a-b1bb-44f5-9483-aae9cb10a9e8", "comment": "Malware payload (Mirai)", "value": "f676ac2ce033ce79c0565740856de05bb59757f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542675, "uuid": "b5235144-44fb-4549-84a4-2f9629a24e1d", "comment": "Malware payload (Mirai)", "value": "dcfeb2b7bd8f95f0e239da48ef8a05392669213a0167c6c6ea5a51427840993da88cbee82bb813a809805a1203041dd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542675, "uuid": "ea14ace7-af2b-4d20-9f5f-5c43ea35ba97", "value": "T1F4A2C061E2E69FB0F6FD6D709DD1E2C0BBF20BD479D5CAA200441F66832A8536748DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542675, "uuid": "1e060d4e-bc43-49ab-a46f-aca006f6a1f3", "value": "384:w/gNyF/M84Tp2YshxqlDZv4nO23Y1n3nkxRvnKx3tjM4uVcqgw05VxJK:woNytlSVsMDZgF3Q3kGJtg4uVcqgw09w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542675, "uuid": "9536efd1-8717-44f4-a8b3-82f5b41423fb", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542675, "uuid": "01e53fdc-9bf6-496f-af60-11505fbeed50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542675, "uuid": "88e255df-7897-486a-b5e4-7daadee3c403", "value": "31d0d8345bb0a40887513f38bff3d425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2b7f27-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511891, "uuid": "d01e7a43-88a4-42c0-bce8-b4db61d26402", "comment": "Malware payload", "value": "717fccf1e6081d012f06d24872563529", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511891, "uuid": "eb06b00e-bf7a-4325-8373-b985c0f43707", "comment": "Malware payload", "value": "00c5cbf50c23fceebe76e18e53699cadf94d345edfba1356f21c1e37205bdc58", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511891, "uuid": "49dee06a-bfea-4c6f-8869-9a17e1ac7ab3", "comment": "Malware payload", "value": "424fa0c7f0e5ca34084dcd060b86cf279a4ceab1", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511891, "uuid": "5c2185dd-2925-4cb3-84df-45bdc8feb1b7", "comment": "Malware payload", "value": "b88afa7133185b87d99af24c784cb469ea556a08169a732b9053b9ddf61ad5d0ba30fd16ab2dee05ff2c308feb5ee9d1", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rubeus", "colour": "#C7A25F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511891, "uuid": "81fdd61c-9afc-4c23-9e25-aff5bfcf2b66", "value": "T1C6746C0817EC4B56E2BF4330E470519641F5F82AF5F6EB5E1E9094AA2F13782D811BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511891, "uuid": "af41ce0f-e632-4bb0-b8f1-3ddcd8de0812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511891, "uuid": "fbabf17d-c806-4b4c-a3c6-ac66878e4dcb", "value": "6144:kMv8euxK5yXCyf5Xe1hF+Wqg1/cfDIQzdHJt39rPv0oHBSyz2cZJp:/8euxbyse1DBOf8qz9rlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511891, "uuid": "7d397c43-4c1f-41e9-ada3-bbc8900f46d1", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511891, "uuid": "bbcd3226-edb2-40e1-affe-1deeff2f1df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511891, "uuid": "924c9839-3aa6-4409-8e62-7a0f6b729aa8", "value": "KrbRelayUp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7b1513-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659534391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534391, "uuid": "83ee1f11-766d-438a-83ef-cdc49404d068", "comment": "Malware payload", "value": "3541717db37782ef6a007894b1ae902f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534391, "uuid": "8204d1ea-ffa3-427b-910c-d80bd7793987", "comment": "Malware payload", "value": "00e11e8dadf30fec4186d90791774215a54710dd2243db25fcd7a75b7c7079f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534391, "uuid": "87fbe6f6-9275-423f-bf81-e20dbf4a4b11", "comment": "Malware payload", "value": "78930b1c0ccf02700fb6907a9ed1be3ad373477b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534391, "uuid": "ec3722f9-b5ba-4cf5-a8fb-b1444553a5eb", "comment": "Malware payload", "value": "92208616250b3be4591c5ca1007b090ce966b43a79903af4c969fab082f771e9dddcf750d5cd8745ff8213fb175b4601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534391, "uuid": "526f98c5-6b4b-4e64-b175-7c0bfbe053f8", "value": "T1B6543A55A3AC098EE9A7853ACDA39717FBF27C051250D33B5290DB365F33B2AA538311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534391, "uuid": "657618d8-1e18-40fd-aad4-7fee56e96d16", "value": "6144:dCf08fLIWAYpBJ7TBV16yH8UDfQhTi07imE6G4vvQl/cK8c5dMZ6APAkOiJ:dwTAYpBJ7PgyciQh+02mELRvbMZ6AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534391, "uuid": "a4df354f-d497-4133-a5af-295c4836efbe", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534391, "uuid": "401eeaae-71e9-4453-980d-ce9b837fa43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534391, "uuid": "c556fb3e-5afe-44dc-be0a-d8dd0e9e1f8e", "value": "6240000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa535d76-12fd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659511755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511755, "uuid": "e9b129fb-ec5b-4890-aed2-7f17ca6e8efb", "comment": "Malware payload (AgentTesla)", "value": "13a224cf9083781440cb782fedd6872d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511755, "uuid": "335c433c-ed8a-4de8-bfeb-bca4ef10a1b1", "comment": "Malware payload (AgentTesla)", "value": "012c3e714f69ab4549532df1591d39f7610c3efd824eb48a44c236e3993accdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511755, "uuid": "b5b96824-4c5a-4c58-a338-95bf6328ed59", "comment": "Malware payload (AgentTesla)", "value": "79dc4ba7fd93b175c4d6b8149954c141031abb19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511755, "uuid": "df349c75-1d48-4277-95d5-d5f9f4d21d4c", "comment": "Malware payload (AgentTesla)", "value": "fa1222933898f5ec3e28ee91bc746f1a6779126a7c3b607f7c4d9686c92eac6f5eee6ea4d40c7681619a9918d1d4dd02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511755, "uuid": "2b23872b-0af5-4c80-a1ad-4ba63a8bbc83", "value": "T1ABF4AC2124D5B269E0295F378BD094A45BF1FD12F709E66A2DA03387C7F3EB08D16D62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511755, "uuid": "019b99c0-48e2-44d7-aaa8-b4dbfd5c087d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511755, "uuid": "c74f3b5a-1113-4e89-be20-d16f3b16efc4", "value": "12288:ZICcudmChLuyAHk2iNkQRGd65y8SGJJ4ItvfqGT9M30CS6DI:jhLuyyk1lRV5y8fiQiO940GD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511755, "uuid": "437b570f-afe1-4480-8095-78b99a058c5d", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511755, "uuid": "36815470-9df1-42c6-bd6f-4fd8dddfb565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511755, "uuid": "3d90e693-104d-4b68-8867-3c81e5382527", "value": "Processed payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf98492-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537928, "uuid": "d187efd8-882e-479d-a767-edcffc20cc76", "comment": "Malware payload (SnakeKeylogger)", "value": "0dd856f20f436aa64efe0beccae00e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537928, "uuid": "8bcc4e56-fcf8-4c3e-92e5-936c0724f5d3", "comment": "Malware payload (SnakeKeylogger)", "value": "0425d2947e503a0b7cf466adb601f54c699d53597a8323ed20eb7b5583222dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537928, "uuid": "67f68a48-e7e3-4750-ad6c-19b429d5ac5f", "comment": "Malware payload (SnakeKeylogger)", "value": "2070a47d8bb58c5011eced1f8b319068e90e0cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537928, "uuid": "0012a8d2-f504-4f53-bd3a-319b686d279e", "comment": "Malware payload (SnakeKeylogger)", "value": "cfd68bb8ae4b07b07c0e61e92d693d05878dc655dc0361a1a61ad262d5097f364ab2e508d7eb7ebfe38f6ec3a9583684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537928, "uuid": "e97a38a5-86a9-478b-8551-beec9fd83844", "value": "T1D7E412C637B79B13F0754BF1F92080968BF0653A6422D24D5ECA7CFB9875B230622657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537928, "uuid": "149c0abd-999e-4036-a452-d244e7978a6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537928, "uuid": "a57ceac4-6280-4e9c-978b-db0212a0e23b", "value": "12288:vCg6SKlpxVAnJBut9hRLQsr3hmwZZr6631AwvHMthmCeYyrLmdL+tJ6OS0t:vgLlpxVIqlmC6631dPFHVedLpPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537928, "uuid": "cacebda8-cc5e-4f37-aa90-0c51f4a5acbf", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537928, "uuid": "c764ab36-46e6-41fe-9cf5-d3b9f66820d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537928, "uuid": "6161c1c6-a620-46ba-b67d-2445461dae15", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4645f67b-132f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659532928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532928, "uuid": "8ebd10d3-a52d-43b4-bf06-519bbbe9ec2c", "comment": "Malware payload (Gozi)", "value": "a285ba69ef3e60adfce0fe1df0bab034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532928, "uuid": "54e613ac-cf59-4f88-bed7-b89e682a3453", "comment": "Malware payload (Gozi)", "value": "04f7ebb6a7380323e296eb86c1c328099ba11b935cd9394dec58bfac26854df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532928, "uuid": "733300ff-9056-40ba-a302-0cdedaed3495", "comment": "Malware payload (Gozi)", "value": "168f1175be084ed3fe6c0362eddf405cef03d417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532928, "uuid": "b6013762-cff4-425b-8fa1-0bdabdc75ee8", "comment": "Malware payload (Gozi)", "value": "be26a20f4f552427983d9e0b788ea26142a3a28c7265e75c61061237e9a200894f5cf96840ccb3d4fdb9cf9e7cd59a97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532928, "uuid": "985eea24-029b-40f3-a199-85d0d2bf88f5", "value": "T101246C6AA3E51199E96BD6B5CD53D217E7F334492B24C30F53B0CAA66F47722B21C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532928, "uuid": "b803f716-2fe6-4b1c-9411-032e10d1007b", "value": "6144:yOZiNwkzdjpi5azwE2uP3qqMFTXvAe59jwNq:yHwkx9cazwE2Y3q9TXvAxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659532928, "uuid": "5ca3f07f-c123-428d-bd18-0bfc9684de93", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659532928, "uuid": "12f6177c-5181-432e-8455-3af10cf54697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532928, "uuid": "32b18788-2e10-414e-a2eb-84b49724c205", "value": "d900000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cfb42e-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507694, "uuid": "50bb58a3-6443-4d84-a751-03b43e1a79f1", "comment": "Malware payload", "value": "2b09d96ee74a2568645b2cdbc06e953d", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507694, "uuid": "fbddb94e-5e11-4429-bb83-ed53fe819590", "comment": "Malware payload", "value": "0880578c9a50a428faa3591aac7128b5a1c70818bd9b77502a76ff8ecdce84c2", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507694, "uuid": "4aca1ee9-0595-4852-aca5-8fb111632501", "comment": "Malware payload", "value": "382b583cb47e6bbccc62df6fdb7018c10fc4cb22", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507694, "uuid": "51365577-2b0a-4c7a-8966-881301f0f082", "comment": "Malware payload", "value": "e877bc6edaed0f5755b3d0340cfaa3e81e6555997be86bd0144e995fdb5faa91f474d63a353d85774b6ab569bedb5a5c", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507694, "uuid": "4189a5d0-26db-40e5-98cc-6532b17e4ca1", "value": "T176E2A201B2D9ED1BF51585301FDBD7DA7629BC999E06C21B33807F6EBC39A709A12B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507694, "uuid": "ee37e1dc-fba6-4419-adee-7f2ab2062b9f", "value": "192:9fhlLZEvA+6/6rnsqpZtgmavAcEdn+w+O3eypRf0j1be0Kw5NMiJEttza:938iSsqdg1vA9dIUeIRf0j1bHvbEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507694, "uuid": "71b71215-63a9-4d8f-92b0-f8289766c6a3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507694, "uuid": "95e7e089-968e-4aef-9d8b-67080f150aaf", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507694, "uuid": "d2da17d0-3bb7-40c4-88f0-14c069a76a61", "value": "quietmoth1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b511802f-131f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659526242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659526242, "uuid": "d30f6743-8ce1-4429-85da-1992d0f085d2", "comment": "Malware payload (Stop)", "value": "25bb241be4a85c078be92f361f978627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659526242, "uuid": "fb2e8d67-b4f2-4fd1-bc4b-39ea892ca4ad", "comment": "Malware payload (Stop)", "value": "0a1c9c7ebc6754b1c815ed5f2ba39a212b0f899456cb0d28fbfeafe109b88c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659526242, "uuid": "09577217-ca16-4350-a76f-dd7266185eb7", "comment": "Malware payload (Stop)", "value": "026fd0f3e746a991b4f09551db7daa50af51046d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659526242, "uuid": "e9d7e4d1-55a4-4fa0-bb29-86e54df52648", "comment": "Malware payload (Stop)", "value": "76c09463929b7cf1c8b23e4a5e55cdc6404ec94dbcc9ba1fd13c997cb7237fc69adea2e6c3b999feaaa40e7ae5c01308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659526242, "uuid": "a1a2fd1c-b4e8-474e-9a89-1906e3e8aed5", "value": "T190E412A032E1C032D067A771A579DA94D6BA79320B7454FFE354073D1E3D2C0DA3A76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659526242, "uuid": "d2bb5a54-8cdc-4094-bc90-35af559e91a6", "value": "4cfbd807e4155075766f9f516fa9a7f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659526242, "uuid": "988cfb05-7f2b-49fb-b8ba-4b6327277ca4", "value": "12288:miyQvXVNa7X5UC3AixSj+s8QLf1A1Gpdyt1naHVV9FLwSRHwaWgP:mXQvfWRKGMA1GInaHluSRdWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659526242, "uuid": "a8ec3c25-b6fe-4e6c-b069-1e644694a790", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659526242, "uuid": "32a148ea-39e7-4701-9d69-486bbffd101e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659526242, "uuid": "3f28a40f-78fe-46ed-b085-a341d476892a", "value": "25bb241be4a85c078be92f361f978627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd25cc1-1311-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659520243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520243, "uuid": "c883f100-0eaf-4807-a4d5-13496202dfaa", "comment": "Malware payload (RedLineStealer)", "value": "4d8e7a59bfa93641deca3c852f8162e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520243, "uuid": "b2d23607-87ba-4009-876c-b9f3676109dc", "comment": "Malware payload (RedLineStealer)", "value": "0a4ff0072b746cfa5298b24b812c3f05f300950ce3485e9931bdeda78a771af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520243, "uuid": "2781447e-902e-46b1-8c06-ec7070b3029f", "comment": "Malware payload (RedLineStealer)", "value": "df7e54b57dafbd91165f28df62e7240f3941517d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520243, "uuid": "67e334f2-128e-400b-9b55-10424da15ebc", "comment": "Malware payload (RedLineStealer)", "value": "29ad25cc688c7fb7bbd3cc9aab7adad7d9db1711bf4d87fb11e6042d59fd6156ea090306374f74fe1d04707992559d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520243, "uuid": "1e3eba01-e3df-4d11-a987-1b555df1b74a", "value": "T14EA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520243, "uuid": "7225d3ed-f461-43db-b22d-ce8614b58e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520243, "uuid": "c888cdd1-ed25-439f-b589-d310ac172dc5", "value": "1536:5qs8bqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2wtmulgS6p8l:XOwiYj+zi0ZbYe1g0ujyzdM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659520243, "uuid": "41e1317e-6ecf-454e-8d95-1c57dfca57dd", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659520243, "uuid": "b13a42e6-16bf-4aea-9be5-bb6e62cd4410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520243, "uuid": "03e7b1ad-de20-419a-aaeb-8c64e96d43b3", "value": "0a4ff0072b746cfa5298b24b812c3f05f300950ce3485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968723cb-12fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659511158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511158, "uuid": "e6ff369f-8fb2-4a38-aa13-5629f131bb8c", "comment": "Malware payload (SnakeKeylogger)", "value": "397ebf5486ef3c7a261e9644de31bcad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511158, "uuid": "00587a42-d218-4cc6-b4ce-19d829068b1d", "comment": "Malware payload (SnakeKeylogger)", "value": "0babace1851b0c2b22842ccbbacc6b7b98c8f9e628a3f77f931e8d18e8776973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511158, "uuid": "ea4f442c-89db-46ae-a8ae-1ad7dfb7eade", "comment": "Malware payload (SnakeKeylogger)", "value": "13045e405391564381bdfcdbef5339a7dd7e7213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511158, "uuid": "e0564671-9585-41c5-b286-2c7565ea5423", "comment": "Malware payload (SnakeKeylogger)", "value": "8f97a539c9a33b4eb322e138a87910df2277aacf5b718003f9f0551868cec4610766adea99c4baae68323a9f8c02618b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511158, "uuid": "bb1a9871-531d-4308-b628-ab019b49eedb", "value": "T1FCE4124673B25F23E8B98BF6E62040860BF536765423E3890EE93CFBA5727534312653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511158, "uuid": "df5bd3c2-2157-4882-b587-fcf3800e643b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511158, "uuid": "4ca96377-51be-4e07-8926-eb989ef94a29", "value": "12288:0g6SKlpxNMX6mu/0b0yYuNnPjP3Viq7upwXk9HW1:WLlpxNMX6m00A4NnPbVeKWW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511158, "uuid": "663e94f1-f3ed-4334-aae8-ae4ca8cb5b8c", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511158, "uuid": "2acab2c8-16f3-4fe0-83ec-3be1c6598a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511158, "uuid": "070a28e8-b50b-492f-89e2-f8ca4804ee5e", "value": "jJhPNebw9iEq6MQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f09a37-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537922, "uuid": "c160155d-a355-499d-9751-8837ea0bac84", "comment": "Malware payload (SnakeKeylogger)", "value": "51625928bfbb6fcb35837c35576edfe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537922, "uuid": "d8e16604-9e75-47bb-97be-cc554bcf15a6", "comment": "Malware payload (SnakeKeylogger)", "value": "0bf20915664398e96f5ab93c46e022d4f712288d1af75a1d43beb3f4555bbbca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537922, "uuid": "d4382f8a-67b7-4e57-8249-d4a7a612ba8f", "comment": "Malware payload (SnakeKeylogger)", "value": "972c79739b8a3ef152e66afdf6f1f78962a31887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537922, "uuid": "6c56defd-7d8e-4bb5-8fc7-5dba0a6108ab", "comment": "Malware payload (SnakeKeylogger)", "value": "83ddc758dd3be19d8cc09c6d94a42352d0afe725c5d10d56bf44f6b0115605178a84ea1a795d65c29f2c23d78be46de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537922, "uuid": "4a4fdfd0-7dfb-4868-b8b4-bc8a27a1eb05", "value": "T1C0A4ADA3E09548A1ED9D17325D3B5D2E03AB7E767EB4E51D221AB13907333E3006AD4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537922, "uuid": "757df71b-f9e1-4755-8c3f-92837fc864da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537922, "uuid": "277da48d-dce2-4982-83fc-27b5b91b77c1", "value": "6144:u9dzsElSSxmJpVhcvDw4I9LQ/RDF0KOZZxB1Sm0JaIEgGiZEa3r:u95BSSSDhcM4I9LEZ2LxjsEgGiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537922, "uuid": "b5780f8f-1963-416c-b3ae-36080d1f27a0", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537922, "uuid": "fc6d0b82-27f5-4b2a-8e84-c81dfb4d2cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537922, "uuid": "26494e2e-e264-4fba-b99b-cd7c8ab53937", "value": "PO-MI77001213-SEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2ffde2-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659512105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512105, "uuid": "0c6c186f-0847-4829-96da-c9a54ce880e9", "comment": "Malware payload (RedLineStealer)", "value": "93b0ed143a2e5459b714f424b36f3f78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512105, "uuid": "482ffec0-a339-4d26-9614-7fd5ab770a18", "comment": "Malware payload (RedLineStealer)", "value": "0cdc9aa15fed28f0a8cdd04dcf04ca74349400b830df3cfcdcbe6426ca24bd65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512105, "uuid": "12199a9b-2aea-425d-bc74-6b091fb39dee", "comment": "Malware payload (RedLineStealer)", "value": "ea41de34120b58f422a1da39ef692d0cd8bc2f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512105, "uuid": "49a52505-1e1d-4db0-b85e-cb4eda0d17ee", "comment": "Malware payload (RedLineStealer)", "value": "c9528ca446f853b350afb96564224f02bf8da2e739e4d4ab6d6c9677f9a714a7f5a50746a762c762d6b0a9faa5bac38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512105, "uuid": "20e05280-bddf-4541-8ed8-056fdc4c1a0c", "value": "T10BD4B45C76C58A7EEF1EC8B0880186667B231E17E201698627CB39C7A7AF75D1F05F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512105, "uuid": "7e6e28b4-0ede-4ffb-9118-b15f358718e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512105, "uuid": "07dcddf1-272d-4023-9777-6b7f19f8a81a", "value": "12288:Ct+YzFqQMLOktdY9Mc0gGNZLDfjXRh+cy6:EZTYcONZLDfjXr+cy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512105, "uuid": "fb601d77-6661-4042-9722-ca2595e5b19c", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512105, "uuid": "8abe6a13-cbcf-4dd3-89fe-f7caaf86d96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512105, "uuid": "f147beaa-90a6-4254-8718-1cfbcfec51b3", "value": "model 345555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5d57c4-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659512829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512829, "uuid": "5a78915c-0345-4d28-bc4d-1c36e5c032e1", "comment": "Malware payload (Loki)", "value": "d7a37f86583afb2299a9492804ae8c87", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512829, "uuid": "47b9d530-8f44-4efc-8b40-0393d6588fb8", "comment": "Malware payload (Loki)", "value": "0d894c0634127bb3340160bfc44b6e0f06dab3340b75a7ec79af002498cdfb63", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512829, "uuid": "01cc6072-b383-4fb0-9a34-c52ab288424c", "comment": "Malware payload (Loki)", "value": "a6d9e10da382dcc4b62109c89beb6d7e2a40c323", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512829, "uuid": "ecbfe52d-03c5-4dc5-b0db-79142c8289b1", "comment": "Malware payload (Loki)", "value": "152693aecad2aa827b5fa6c3a0a5747a049b8974d24ae29c6957effd135128e4b00bc2d93a8a051543c8d41c70fda744", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512829, "uuid": "415864c1-da93-4d80-97a4-73c5a79da425", "value": "T158341251BE4F084CCB5793B4BA4FC5A944B6CD4FDA6611D935F033269AB96C08F0AE0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512829, "uuid": "e02b23b9-77e3-4cb1-914a-9bdcf265790d", "value": "6144:BXJFaAUgCIUbj+8UCgQAqYE9im+13WhKC5ev/x9LDFsPB:8gCjyfQAKMmUAKC+xLsPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512829, "uuid": "34508fb4-50c8-4b61-b97c-9cc7cd74766c", "value": 246104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512829, "uuid": "658c2a93-acb2-45ac-8998-edf3452d6bf8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512829, "uuid": "cfa71d73-3b10-4436-8b91-e449694c7066", "value": "Automated Slip.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91cce21-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "b6a67961-a0c7-4fd6-acc4-0655f9299c8a", "comment": "Malware payload (SnakeKeylogger)", "value": "866f10faccabf466e8ac4b92e9d87541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "9802d912-17c4-4658-a772-b3f4ed655bfb", "comment": "Malware payload (SnakeKeylogger)", "value": "0ebbeb7d1ea678541e507e86b15fce29ea2a71461163fc46b98f1c4e679ce3ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "a255df1d-c017-4b64-9ce9-75a3c0f8ca29", "comment": "Malware payload (SnakeKeylogger)", "value": "c5c8f3a1742007d443191f268fc73066cb531fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "fb3ced9e-295c-47cf-83dc-4ed29cf7b64f", "comment": "Malware payload (SnakeKeylogger)", "value": "51afdde49154dbbab6deffc69ae71e34453650d49fcece4ea89124a07b6c15c37a80703c6cdeec59508a326da5cfdb27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "28396b5c-5593-48c2-9338-3269a46acca9", "value": "T1F6F4E04177B58B03E4BB0FF5A4A041241BB376693167E34D4DC978EA6E727438A1BB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "d4158990-3ad5-42c3-82a7-c92fd565730c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "63bf6da5-2e95-4414-ab0a-c52033cd43dc", "value": "12288:g8g3g6SKlpxxMOvSujpqtcwfpTHgFoYwQJ8LKtrCHX/5Gg/Ne0znTg:a5Llpx1au9qtcwpHQrwQcKt2X/5Gg/gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537925, "uuid": "bb5ccd43-b607-48f1-86d6-7ad188851baa", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537925, "uuid": "83d752c7-6945-4099-86f4-d6e5373c07af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "5cf449d5-3061-4c31-b7ff-27b0afda57ea", "value": "FYI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a1fc0a-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507554, "uuid": "ed815571-e411-41c3-a5d0-d746b62bd71d", "comment": "Malware payload", "value": "3391064618457bb86ba67fe74507c302", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507554, "uuid": "86dfbb42-f16e-49b4-9ad1-381faea4f72e", "comment": "Malware payload", "value": "0edf219fdf56fb6e0e69dae0538cc82427ac8ae8616bca83a3518c7711fa84fe", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507554, "uuid": "4b731704-103a-444b-a125-812796160a85", "comment": "Malware payload", "value": "72d90cf6abdcd485f3d6c1c9160e2fde8be82aaa", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507554, "uuid": "bceb0900-e192-4529-a286-eb79ca8e6b01", "comment": "Malware payload", "value": "b6e6efefeb370c445e2b7ed071d1011d7dba0b87b3be34e1d125ea2fe171d5d45b6b44ee1ad3bcc3ef55246ebd9dfcbb", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507554, "uuid": "475f188e-d687-4a2f-aa52-669457984e36", "value": "T1F9018E94C79CBDBE1A20B78A6017DE44B075092E552EEC8232CDC2CE02AFDDD431A262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507554, "uuid": "feff6644-e8d6-461c-b888-3524a6929260", "value": "24:DNXjAWVmouPfio7MDa207p8FIyXxhnLQng7FfheOnyqI:DJjkouHRMDs1WhUU53nyqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507554, "uuid": "eff020d4-4643-41b2-8696-19953fc048df", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507554, "uuid": "b3dcf4da-3825-4fbc-a6ad-7fd6a3bc9c9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507554, "uuid": "532f2cc1-0648-49c0-b651-9f03e103d5e9", "value": "reverse.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b43b353-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507649, "uuid": "2eee78b4-9eb5-4424-984b-935bcabfdb30", "comment": "Malware payload", "value": "f897da43ba29db020d178b21b0e892ce", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507649, "uuid": "4ff70595-7ce4-4c06-8e4d-ced74f820f39", "comment": "Malware payload", "value": "0f0a6eae9df1851b1e89ee9ba9c3b70067e3f99d8620d56bc6d2ed73fd7309ea", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507649, "uuid": "2eb823c6-a68b-4a0e-90c3-582069871452", "comment": "Malware payload", "value": "d91fd28fdbabb70b47f1f91aa19dfc35b0160e61", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507649, "uuid": "dac6ccd4-ac1f-4077-9e18-2980567853bc", "comment": "Malware payload", "value": "485efa5f4e0e160c28019c41ee69b7a275b66b0427dbd8bc4da9ed36901d0920c99554091b1276aefef4fdbbfb6fbb80", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507649, "uuid": "7a83c9f8-c3e5-4941-9c26-d005631dd891", "value": "T14F736B05F384E937FA1649356A92C9AB2A193C773A45C91635C63B2FAB73F700DB0E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507649, "uuid": "23a4c3e1-f1f6-47c6-bf75-30984c51134b", "value": "768:8W1pRWhjadPn2IsfaymaQiYPj3E7Cat/c+1o9y/5xCSvHvAPiWk:8DUn2hmxiYPrE7ZW+a96PKXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507649, "uuid": "808f185c-4725-4404-8ffd-42778c50ffcd", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507649, "uuid": "ae6a2eb4-fd66-4e15-8515-a35400b021ee", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507649, "uuid": "b72c1e60-9e93-48fb-9903-8e90572d512d", "value": "0f0a6eae9df1851b1e89ee9ba9c3b70067e3f99d8620d56bc6d2ed73fd7309ea.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f90247-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659539074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539074, "uuid": "c690818f-abd4-4e42-a832-1e7e805d0373", "comment": "Malware payload (Loki)", "value": "61b9dfbeb589010d86e7da37a643eb04", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539074, "uuid": "fff9e666-e821-4dbf-968a-5f50a143cce0", "comment": "Malware payload (Loki)", "value": "0ff035163283aa6fe9443ca619c38fdb50c3ab822c197a473bda11711b52eaf3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539074, "uuid": "29853174-bacc-44a7-b513-5db275d34653", "comment": "Malware payload (Loki)", "value": "a2a8b0aa037a31019117516565ef0a378625e777", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539074, "uuid": "737e6a6b-3970-40e8-a48d-f04768110a84", "comment": "Malware payload (Loki)", "value": "3b176eab334694f59d5081a85f1a7988de7453e5c66e06c31fcc69e56dddcca6a1adaaa0920f490397e0da407b763cbb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539074, "uuid": "b529df20-8e5f-418c-9f45-82bc46d7b1b4", "value": "T166E26A9EB2EA578CE24A73F54D44B027CFFB9C6961F652931049BB04883323B5794637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539074, "uuid": "98c32395-5570-4e7d-be54-964c3237736e", "value": "768:8VgyCaC7IqNnMdEBuYZxyulMpJs9+4YIBMPdnRSN:8WyIrNnMdExZxyulk+HYSM5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539074, "uuid": "f7a2769a-a9bf-403c-b272-091bcb26ef95", "value": 33096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539074, "uuid": "26b207ed-28d6-426c-8140-27a4bb7db9b6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539074, "uuid": "800a1272-e745-487d-bb3b-0fcabfc12fb1", "value": "PO_22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ac002a-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495045, "uuid": "2d2894d2-80ac-46a6-a4bf-982673089ebd", "comment": "Malware payload (Mirai)", "value": "ab4d9723995f312a040c9ece660e0bb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495045, "uuid": "916fb232-3cd2-4e71-800a-8ff42b3747f7", "comment": "Malware payload (Mirai)", "value": "1009f1e2c72bdb66c313a6b9403cbf9436c84436b568227f66c2bbc8d694d646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495045, "uuid": "b8df470d-cabc-48fb-a4fe-a09ae385ecdb", "comment": "Malware payload (Mirai)", "value": "d358b93265e9ed096de1aa2961ced99d65151872", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495045, "uuid": "d080daca-3636-48ae-a986-5d492e8a712b", "comment": "Malware payload (Mirai)", "value": "d4e10156b1502ddfb00043849885ec9e26db2998e726d55056d8b02ed09121d098896304399a6253c7c1cc468362118c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495045, "uuid": "d9676426-d89a-468a-ad05-f159d686fe6a", "value": "T1E2336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495045, "uuid": "a6894fed-5af1-48fd-8c79-f73d958105da", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495045, "uuid": "004f54f0-49a3-4547-80e3-4b905154d953", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495045, "uuid": "e4d6dbff-4712-4df7-8053-95679807e28e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495045, "uuid": "ca5d6618-9144-4a5a-a3aa-14e9d51f563f", "value": "ab4d9723995f312a040c9ece660e0bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afb3c58-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507703, "uuid": "1c9b50eb-e6f0-4645-9cfb-29f4375865bb", "comment": "Malware payload", "value": "7fe89ee45db16bac545d37410dec0e7a", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507703, "uuid": "f71075e4-86a5-4b16-80f9-c3226e3ee09a", "comment": "Malware payload", "value": "109fe9b00b39e8556374220f84c73dc3bb8c9e63362a9a910affa797597781c9", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507703, "uuid": "9c07f5a3-81ca-485e-adc7-ad9d3e6ab20b", "comment": "Malware payload", "value": "79b94d017733015f3206c2d058ffeae316b3b374", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507703, "uuid": "1d13f69c-fc42-4d9d-8d98-b1abd014ff64", "comment": "Malware payload", "value": "0b6d3d43cb81b4d7dda8911703c1999155200cc3222e94ca50d8fff1f7776549060bdb1ad1d3bc819b9548a095081886", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507703, "uuid": "8bf62828-9a7e-4e70-9244-69440fe31bde", "value": "T121D3AD35F3D6EB15DB0B493D0ABEBDBB27286CC569C5810725423E69A979F700A1323C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507703, "uuid": "45289704-d54b-4219-9f03-1d1d4dc95669", "value": "3072:SH0vx895EX0YWPqSrRgkEdyezKWgHHqPKXk:SUvy96vWPqxye3cKPKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507703, "uuid": "0a933458-ee03-4cc1-9206-b4b7f8e9fc95", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507703, "uuid": "8ad3aca5-b726-484f-9261-87ef4496a381", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507703, "uuid": "1c7b57e7-06de-4bef-86f5-5536c85d29f7", "value": "rules_to_deepins_helpers.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fc1978-1382-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659568837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568837, "uuid": "63ed2638-cef8-4757-b812-31707d81a8e4", "comment": "Malware payload (AsyncRAT)", "value": "458d35051c24f8237bfa0732d254cd9e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568837, "uuid": "69706c6e-68ab-4ad4-9e3e-3025aa61eb72", "comment": "Malware payload (AsyncRAT)", "value": "1166e3200fd3a2a7e448f8129fbebdd7266a85393e8d6596ee6f89653adba1d0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568837, "uuid": "12c779f7-d50f-4229-a1e8-50ce2e72381d", "comment": "Malware payload (AsyncRAT)", "value": "2cb74c406b79dc3e89fd6ce1c4e9e6d29e5138e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568837, "uuid": "ec1c5fb7-11aa-42d1-8884-ea4364ec9437", "comment": "Malware payload (AsyncRAT)", "value": "8a3cfff6f36ad6952ef2b7fec0eab1c6970d317b140680e2703efebb7f1f2e12903861587618ee568780c39923b3ed1f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568837, "uuid": "e0242d8e-2421-46a7-9d67-55e827783b91", "value": "T1D733DF81A6780533E5F563B450138305932FEBD40705F6EE76D4E1EAD8AE26BCA13EE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568837, "uuid": "4eb8e69b-8dc4-44c2-8fd2-d43d1be09241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568837, "uuid": "0a92123a-7443-407a-a1e2-5d81d9702621", "value": "768:NKJ3QnvWuImL3xFWLK+DrQuHJQfjyhq3iH+HIj64NFZTilPqn4oYrTe:NWQmm3GbQUhqk+0/fA+4oYrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659568837, "uuid": "44a4d2fc-af66-4b59-bff4-a32d073c39ed", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659568837, "uuid": "c789f62b-0103-40b5-94a6-3765f7534896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568837, "uuid": "8bb40585-a3fa-41d7-b5f1-aa2178e38542", "value": "458d35051c24f8237bfa0732d254cd9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a970b6c-1302-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659513634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513634, "uuid": "79ebc698-a11a-4b69-842f-1b01c1101913", "comment": "Malware payload (Stop)", "value": "08e427f629429a1383a20a1f633d98e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513634, "uuid": "b0bbb271-893f-4a40-9c8f-3c39e1663e1b", "comment": "Malware payload (Stop)", "value": "11b50a72b92088693c236ee689690b8c9510a38a51bddc41c40e22186c948745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513634, "uuid": "49d6d59b-58ce-45c4-8206-038f4cc56a2e", "comment": "Malware payload (Stop)", "value": "dc0377578de6d4497d2a2e35706da513a88c77aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513634, "uuid": "9a4d8546-8622-40ce-a2ae-b7057398e11f", "comment": "Malware payload (Stop)", "value": "0ef9317b17dda5c6442a186485220162e61ee42422f84276f8019c33ed26e6d34e82b2130eba08a4b78326bb4f9ab659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513634, "uuid": "867c008d-b1df-4e47-aa51-d08cd3fec19a", "value": "T1551501407BA0D439E1B712F47A6A83ACB43E7EA15B2444CF52C62ADE67346E1DCB4317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513634, "uuid": "b8501ffa-f3f2-4ce3-b117-970d9a314c79", "value": "7e4b40ca154bd059f7d22ed12b0ce64d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513634, "uuid": "035d7788-1b26-48b9-a0d6-742211132704", "value": "12288:6kNZAuTp7bH7zjA1rMn44ysmEBsuNZ8mh0Hx1oLjWc0L+fvgEcLs6un:dL7PfA16mEmMemhm1omc0L+fo0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513634, "uuid": "bd6fa4ba-f1ed-4fab-b877-b45cf6522f07", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513634, "uuid": "04fe3324-7f85-4dec-bcf9-be0601c462cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513634, "uuid": "4a49f7f0-c586-411a-92f2-cf5b8dfb6140", "value": "08e427f629429a1383a20a1f633d98e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8515d36-12cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659491860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491860, "uuid": "6b58d801-e2a4-443d-85cf-94de29f4bb5e", "comment": "Malware payload (AgentTesla)", "value": "ea28336146a1f2e4008a2854c8be8965", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491860, "uuid": "b871dbdd-a808-4cc8-8e57-6a22149b8ee3", "comment": "Malware payload (AgentTesla)", "value": "133ff6cdcb6a5fcd2e8c850d0bdd7c35fa5caa702f3e96622c84c319f8b2cf4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491860, "uuid": "30e3e0c1-fc7c-4fca-a6cd-c1fbbf4f918f", "comment": "Malware payload (AgentTesla)", "value": "27e5dc0635469005434abb9d007c8a999920a0fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491860, "uuid": "416c3f48-eeb7-4103-99b8-77845689a663", "comment": "Malware payload (AgentTesla)", "value": "cae6479b7591d33fbd99a6c6babb39752c595b50adda3d7eaa2d79d793fb87b83aba58a90779de04b46ae24262e977b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491860, "uuid": "1fc8434f-8554-46f2-9302-f5d5cf84426d", "value": "T19263E69C779079CFCC5BCD72A9A81C24AB20B467671BD293A44351AC8E4CB8BDF151B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491860, "uuid": "5f24a47d-3f30-44c5-9607-1796077010d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491860, "uuid": "baa2f7f7-bbda-474e-ba15-12f567e8e726", "value": "768:Fnn0abD+QR64q3bFeTroMjibBwmOrWiIeEqlHrdUeUUZmH43i1L1KgZ1h:aauQR64aJQrTGAIe9jJ6YS11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659491860, "uuid": "4d8605d3-e70e-4ac5-80aa-6587b834b6f6", "value": 68640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659491860, "uuid": "e682679b-e5f5-49ab-a7f4-115f60bd6d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491860, "uuid": "b79cf5f6-638c-4557-b523-deb200aa7e3e", "value": "ORDER LIST 1&2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91633cb4-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507713, "uuid": "6f6fe31d-7501-48bc-b7ab-4ece49ef2dd4", "comment": "Malware payload", "value": "d5ed48f523684f70ab3ba695d2a9adf1", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507713, "uuid": "1867e49c-2979-4ca1-b0c8-e80bc5335740", "comment": "Malware payload", "value": "139cdde70d9bc49cf49f8ba2e44b4eba74b3e3f8f20968c025720d1918ccc0e2", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507713, "uuid": "59454b61-c546-42e8-a53a-4e4011ac6017", "comment": "Malware payload", "value": "901c9e99c6c18ffe10bf581d0c24b51bbcca45b0", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507713, "uuid": "4fe8ede1-67b5-41e7-a07b-4d2ccaf765fb", "comment": "Malware payload", "value": "c5a1a4dc7f2c7423232010aa9a25a99bdd18341a90fbdfb00886f76d7c0e29868f0c7f5cdb8a44f7191a390aa7b97426", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507713, "uuid": "5b97b7f4-6fb8-4328-a87f-06d9a60afeb7", "value": "T1E6F25F12B3DACD17F1621A354DD7D3C6B23ABC599E16C30B32407B2EBC752719A22B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507713, "uuid": "591017ab-3de8-443f-b91f-310d2331d825", "value": "384:STWK508iSsqdg1vA9eO8DljukUZ0jCYtGfVR6Cw8:STWK5J+1o9BkljNgdxVR6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507713, "uuid": "cac1282c-4060-40d9-8f62-3a8fe43ebee6", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507713, "uuid": "2d75f068-4f74-45ae-b8f1-dc69a32da13f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507713, "uuid": "a7d9c9c9-68ca-446f-9404-7b468dc6d80b", "value": "standoff.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c677a69-130f-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659519114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659519114, "uuid": "5445cb17-aa12-41e7-aaf3-56b31067e509", "comment": "Malware payload (AgentTesla)", "value": "b4b1adce6d4b116afe155679a0890b9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659519114, "uuid": "e23a7bd7-292c-4c91-93cf-c99b1fbbd492", "comment": "Malware payload (AgentTesla)", "value": "1406976ef0e50ea7ed59ff0a8175c3938694b2d2f8bf113e3208fdb48cb9c0a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659519114, "uuid": "9c525c77-48fb-4728-9c53-ce48209ade2a", "comment": "Malware payload (AgentTesla)", "value": "637e83c908a5db7e9f1fc5f5e1d2a0835be4a951", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659519114, "uuid": "2a4f2b51-9baf-41b4-ae4c-81021e4b178c", "comment": "Malware payload (AgentTesla)", "value": "15b4f2dd5912002e11577f61c241d0747f26f92257cc87e986f4c1c02daece92bc98f19c62b457595ad15bcbac3d5829", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659519114, "uuid": "7712b5f3-a0aa-4193-9157-7abb04b5c6c8", "value": "T1B405E00077B58B17E4BA4FF5B5A440144BB37A5A7423E35C4DDA38EB2DB27134A1BA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659519114, "uuid": "154cac61-4a7d-4ee6-85ec-b4c5ee119648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659519114, "uuid": "c2d5794d-a7d0-49ad-931a-4bda9a7939a1", "value": "24576:L1LlpxbcCIG0BVcU9m0Rmt8z6G8Ej2Mn:LvbQGOaQmmGM2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659519114, "uuid": "1ffc37bd-d2b4-4c9f-a67b-1984bf21ba23", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659519114, "uuid": "a5f77f17-aae4-4e39-9edf-efe98daef600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659519114, "uuid": "62bd0e9a-3913-4f11-994e-a6183fac79b1", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c46027d-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Renamer)", "timestamp": 1659539407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539407, "uuid": "da8a2287-6f9a-4121-8c47-ffac44bf5e70", "comment": "Malware payload (Renamer)", "value": "d0a0719d8e825d8335e37e291f5c73ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539407, "uuid": "faa4fe86-d7b3-4db0-a517-a978418a13ff", "comment": "Malware payload (Renamer)", "value": "149f85afc993b8db6e75b52a50a77a3ac2bf3490c13ef4151842c06318407312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539407, "uuid": "03abb9a4-4650-442a-9707-28dc2be8b3bc", "comment": "Malware payload (Renamer)", "value": "5c982d6362b1d63f1c92f4a5c1a2481a2ded492e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539407, "uuid": "c731a2cd-da92-4e9a-a2d9-e691b1242ff7", "comment": "Malware payload (Renamer)", "value": "3022846d904b58ee42991ff5e9a3818546ba82963ebbe3b073d005582927d337f09356fc0d40b8548a2c467bbb40d1d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539407, "uuid": "4e110b1d-e3a4-497d-a2b8-37c309661871", "value": "T15175010BDEEB116BFC552B71D02548B310FBF9F60F464722B6E1E60D2A70FA165384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539407, "uuid": "dd23cc80-7f24-4017-abd8-ce3a6067af57", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539407, "uuid": "3746f950-a75b-42de-aef8-966553bcec4f", "value": "24576:lcCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQhA:WCpn8t74iA3qb6W8cU4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539407, "uuid": "dc124e3f-e02c-4011-8680-f4058db07df8", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539407, "uuid": "bc3196d7-2ee0-4fac-976f-8453b463ecec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539407, "uuid": "d342752d-21e6-4340-b86b-792a91447489", "value": "Sipari\u015f Metak_WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f83656-1383-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659569119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569119, "uuid": "a76916d6-9145-402b-9279-7bbd1115d2d9", "comment": "Malware payload (Stop)", "value": "df27d0fdf83b641fd0e7f4d54304653d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569119, "uuid": "a14b6507-7053-4383-9ae3-78e32b7ab6ab", "comment": "Malware payload (Stop)", "value": "15ba73be22ef47cb0c848e2389a94e1deb7b13dec4f282d96802538766f58b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569119, "uuid": "7e82eceb-8654-42d7-b8ca-cff0d22de73e", "comment": "Malware payload (Stop)", "value": "015210a195d9c7a7ae45e0e4dcc8aa3bece4b480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569119, "uuid": "b2c918a5-7aa7-42c6-b5eb-ef1982d45f9c", "comment": "Malware payload (Stop)", "value": "06131d3b5f04ab28786fbe037504fb25fac18d3fd5fba18b8bd4a7d414007adca37aaf8e1719c3787e907ac2b1102c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569119, "uuid": "7e4aff06-fd85-4dc4-a946-0ba2f3c2cff4", "value": "T157F412F072E0843EC1A626309E756EA0197DB8632AB499877394171E6F757D09AFC30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569119, "uuid": "ce6444ef-759e-479d-bcf2-3606f9d9952f", "value": "b17c65b0a8ac01a9e7c26566c998beb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569119, "uuid": "5237bff5-b4d9-41fb-b717-28d669993677", "value": "12288:XBvQJnSyrAE/f1LywiXQgkcY51D7GEgFAVMf8XPbiWnTVUJ6/t+Zj:Xynz/fXiwcE1aEU6MqGW86ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659569119, "uuid": "861548c5-86f2-4f91-bbec-8ea6757343d6", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659569119, "uuid": "67a95983-4df7-481a-8997-0472237cb464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569119, "uuid": "fee6fa41-0ed7-432d-9828-4934c1f9b65a", "value": "df27d0fdf83b641fd0e7f4d54304653d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9849e406-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659539078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539078, "uuid": "6a05df8c-fed0-4264-a508-1d38e6b6b0a2", "comment": "Malware payload (Loki)", "value": "010a0f4094fe9e3ce8b9412e5f7eefa9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539078, "uuid": "d6603ba2-0f16-4038-a963-ca3f872009d6", "comment": "Malware payload (Loki)", "value": "1789f9d875c3bb5016394226639245f56c5a56e144c6fe3cb0f4e18bb9f2b4a0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539078, "uuid": "57126155-531b-459b-b496-ca5126dbc784", "comment": "Malware payload (Loki)", "value": "fa5a98e579075597958c5b0bdd3873c1820e85c7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539078, "uuid": "634a26d1-e929-436f-beca-84ab4b369f89", "comment": "Malware payload (Loki)", "value": "194fff297ea444c4a75ba7dcf07bed1f5937392478e0f0a02c1efd938c58312cb654bef5d13eaafc9cbbd32479c4bbaf", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539078, "uuid": "bd6943b2-5c50-4e96-bd38-0473bc9c122f", "value": "T10383DF3D7BAC4266F069EB3FA21BA741452B1C7EBE23A119D50C71C8D538FC4B849A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539078, "uuid": "fb14d659-5caf-415f-a90f-5724f3e4060f", "value": "1536:9ix3zyDN0cTNZ2bJkbJ7yO2Y/WHYSzR0c0tXTRYhUea8rANaqEhsx6rKvPuXVPY9:9ix3zyDN0sr2bibUO/JWicYXlq3a8r0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539078, "uuid": "0419390d-6dd7-464a-9f13-f90e129c93d3", "value": 83000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539078, "uuid": "571beb81-9df6-4635-a77a-5abdbd937287", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539078, "uuid": "4f388c86-586f-4eef-b03e-886a5185d3cc", "value": "PROJE S\u0130PAR\u0130\u015e\u0130 2022RFQ 8388292.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d778da-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1659534192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534192, "uuid": "45fd9683-d124-479b-a72c-2d0e500f516a", "comment": "Malware payload (NanoCore)", "value": "5396592effd98de57e14d12ab97ead64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534192, "uuid": "32a10205-8fe5-4bc1-adcf-172511abcdff", "comment": "Malware payload (NanoCore)", "value": "17a0e81b66dbeee4b2774d04039fbe7768072a7eee3be560fd497f82e8e7ea3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534192, "uuid": "b7a2f803-1d6e-47f1-9d79-ee63b369ebe1", "comment": "Malware payload (NanoCore)", "value": "fc3bfabee6a5eb04d3d5875f2d439117aaa17e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534192, "uuid": "c98f14dc-028a-4b0b-a6d6-2d96f70eeadc", "comment": "Malware payload (NanoCore)", "value": "7101cead81ecbe6dd3a2b8818ba90cbad63634b27ed8d07ca2af239997c9fea08e9dbc39c339290115e3f668d387ae19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534192, "uuid": "9b1ce305-fd18-48f7-9f16-84ce2d9ed782", "value": "T1E805E04177A58B13E8BA5FF1B5B041104BB3766A7422E39D9CC934EB6EB23434A17B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534192, "uuid": "7a089681-9243-488c-8aa2-38533bb450e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534192, "uuid": "a71cc7e9-1898-4655-9f0c-ca141832f6c0", "value": "12288:AkVOD/IpVg6SKlpxNM6TqUXr6TbxcWLAI2AqTIp26PichW7ikcL:LOD/IpzLlpxLTqLNLAIhqTIp2XchWRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534192, "uuid": "19bc10fe-b867-4e5e-bd75-0d2581d6f045", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534192, "uuid": "1556a9d7-12ad-417b-aa3a-c23fc45ab624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534192, "uuid": "96729887-6cad-4ab1-930b-207e45a2a43b", "value": "SC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50ea3cf-1367-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659557165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557165, "uuid": "7015350c-9875-47d6-828a-071f9296da56", "comment": "Malware payload", "value": "fdef19ef2a7256537f2ef85f7426e269", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557165, "uuid": "77ff228f-f494-4054-ac8e-96abdccac67b", "comment": "Malware payload", "value": "183e7f8e2f6c562bac5ed11352741e08920df8b05f95ed4ab5d200966a403584", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557165, "uuid": "2a164d57-6c3e-40ad-a596-7fcafd23c6fa", "comment": "Malware payload", "value": "189311c577c308baf3c020b1736be432eab56592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557165, "uuid": "64dc7afd-907a-4206-8e75-2263eaafd602", "comment": "Malware payload", "value": "a525407cd56deba4cb9d4a875e52941b0c7d8af28a42d746f3f6328edf6c3da9d46bc665237e4f487db81cea69e86ece", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557165, "uuid": "02b5cb4f-ec60-4b31-a2e8-228c648d3004", "value": "T1D873D781739BC632E6D872345A62D33B0321ED0B4679A71B35E46E1B3EBB6021D3D5E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557165, "uuid": "1571745d-fa8c-47f6-aa0f-a801b0d35d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557165, "uuid": "038f6154-cb8c-4c93-a199-f88bbe764cad", "value": "192:MUvoKwPg22UjVKWS6LybCrS7iLyIV1G89FNwUrUUUXXXHXXHHHn3ZHkhUUUUqXnx:MQwPg22oUWSK/BW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557165, "uuid": "a3ca946b-532c-45bf-abbc-ffd8cd3f0fc1", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557165, "uuid": "deb78384-8b55-429e-8ed7-2094b7fb28b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557165, "uuid": "bb6747a4-e2e8-4f22-8f94-0fbef2c04170", "value": "fdef19ef2a7256537f2ef85f7426e269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b674c23-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659557337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557337, "uuid": "2b35d343-584b-4a4d-8379-c22583be7aa7", "comment": "Malware payload (RemcosRAT)", "value": "597fa08c83ef106ae8b29dec82a62c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557337, "uuid": "130c8b7c-a614-4026-987d-1f2714cf2f27", "comment": "Malware payload (RemcosRAT)", "value": "18e45e2e1eb0dc7a6eda50c6762afb2e794dcb2674b9b53ca17c44b92e911c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557337, "uuid": "b5fb7dc4-7852-4994-8a08-22c18b9c13c4", "comment": "Malware payload (RemcosRAT)", "value": "0e63f62cd884bdad1ba699c33c40a53d2d025dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557337, "uuid": "06a6311e-5eac-41b5-be54-893efba6297c", "comment": "Malware payload (RemcosRAT)", "value": "1a09a45c58009370c76094fcea4bcac1855178284e61ca9711e9b0ccd595a8287e80c1cba799ac7a52777a0bad96fa9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557337, "uuid": "e7ac3d99-7cb1-4626-b863-3801af16a3b0", "value": "T1D625CF1022E56A58F03A9B745AE1D43047F6FD17C635E66D7CD83E8BBB32E408A52363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557337, "uuid": "a5f024ce-051b-42a5-b4ed-f2203d3660a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557337, "uuid": "18e5f9f6-a046-461f-81a7-85d771436e4d", "value": "12288:iuJpzzHsE8u07uWi37ghkSgvpjCYjzGqdRFThwWjWkuJ0V6eTseCV9ZATp7ztzb+:hLHAughMxjtjvnFCmuIlCV9CN9Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557337, "uuid": "e40f9986-8ef9-4349-b5d0-95e067f1afdb", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557337, "uuid": "f95a9396-7c60-49e6-81c7-e63243dc675a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557337, "uuid": "edbdadaa-7a36-4e37-8f4e-5ee0e324352e", "value": "SecuriteInfo.com.Trojan.Olock.1.29149.21315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0921a65d-1354-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659548716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548716, "uuid": "7c098428-1d8b-486c-bba8-970279a60f04", "comment": "Malware payload (RemcosRAT)", "value": "04f5b2bd193cfbc571ebb0aac306ccb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548716, "uuid": "491613b6-8093-44c4-b977-6d85905b1638", "comment": "Malware payload (RemcosRAT)", "value": "1951a59d71b0b4ff98fc0499efc2d30c51f02f169580c04b25f702e9d2d46e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548716, "uuid": "dd3d04f6-94ad-4af4-830f-40c523af8c1c", "comment": "Malware payload (RemcosRAT)", "value": "833e8b161d5cee4fea9b525eb6b72377ee83b49d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548716, "uuid": "b00d39bf-5937-499a-b4cf-336cfe34db8f", "comment": "Malware payload (RemcosRAT)", "value": "aeb2bf28277b1031fa06211789d4856c8d0a9bac2ea010780a4483d47001419f6991358d4e7b6099d0bece9f7fec8ab4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548716, "uuid": "35f2ec33-082a-42d7-b251-8efaa95fdb96", "value": "T191A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548716, "uuid": "eaf0153e-8783-47ff-acc2-3c3a0ea17173", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548716, "uuid": "007dec01-4164-4d99-85f8-1d366850f2e7", "value": "6144:3OFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUJyg:3OFtiNBuFgawDB4NOmuwsfZPqyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659548716, "uuid": "637222bc-f25c-4c7c-ac3e-75ee8c692a71", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659548716, "uuid": "f1e69895-ccdf-4620-a596-1e84f3a823cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548716, "uuid": "0feb4076-3292-4e28-ad93-620c6a866357", "value": "04f5b2bd193cfbc571ebb0aac306ccb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ee6e6f-1323-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659527741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527741, "uuid": "2fa0badf-859b-4aea-ae8a-f8b11b4920a1", "comment": "Malware payload (ArkeiStealer)", "value": "a8ef2558341a5ca8ac58ee543e260ee4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527741, "uuid": "2fcc0d73-e2b8-4531-b587-321d0ecd0479", "comment": "Malware payload (ArkeiStealer)", "value": "19e29cc8b874c3dd5fa4b724fb6d5d51db0b7c2fd4e954bb7b1dda228b2225fb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527741, "uuid": "a7398898-a8d5-4194-ae55-c2ebc73dc73f", "comment": "Malware payload (ArkeiStealer)", "value": "5585cc5f17f424639dae06d6feba403c78232f6a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527741, "uuid": "4b0c90a0-423f-4502-9a4d-15a2c7655d3d", "comment": "Malware payload (ArkeiStealer)", "value": "0122922966712fd6c08a4d1e26d16d0fbacd6bdfe83b4e102a0dcb2d604622c921bed21a24f82dc884d31b53d556ae4b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527741, "uuid": "54abfaf0-b39b-45fc-97ce-850a6b338984", "value": "T1DF04BEE137E0C072D1B32A3058B787612A7FB9226BB415BFE364172E0E6D6C09A35757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527741, "uuid": "fbdd76f1-a235-4de9-9927-852f7fae7e1e", "value": "4cfbd807e4155075766f9f516fa9a7f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527741, "uuid": "c2b7fe63-fd6c-436f-a26b-291e47643693", "value": "3072:8xxxgL2AzyQ6w1x7O7SDpJspsrqdzd99r/wKPWKfJUY:8hMbzyY1x7O7SDp+iW399TPWKfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659527741, "uuid": "3843fc35-fd27-42ac-92f8-7fb188e6155e", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659527741, "uuid": "2562f4e7-ef4f-48f4-8a20-683178387bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527741, "uuid": "cf103a46-d909-427a-b7bd-2bf8a2c457ee", "value": "a8ef2558341a5ca8ac58ee543e260ee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0763bd3c-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659539265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539265, "uuid": "21a1932f-0dad-443e-98e0-b114b5a5c638", "comment": "Malware payload (SnakeKeylogger)", "value": "f2de5c55233be9deddec876357bb6099", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539265, "uuid": "71717919-fbc3-4b89-b76a-85f9159c81e0", "comment": "Malware payload (SnakeKeylogger)", "value": "1a3c14db0a3e41eee8e41b16bd966ea1cc53cdd857aedd3fd9598b39985e866b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539265, "uuid": "5899e951-53ab-44f3-b6d4-98d6014a36e9", "comment": "Malware payload (SnakeKeylogger)", "value": "30da2fddfde4236b8c6bf622399e8fe433ca2264", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539265, "uuid": "d6b79954-1bb2-4e27-8906-2e56026efc0c", "comment": "Malware payload (SnakeKeylogger)", "value": "ac9ead35aa8f9833c0a698d6ad22d127e843be02bfe1f4f5798fa35d841169bd8fc49e5060fc46bd4871e68b0cc0c0f1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539265, "uuid": "54c34d73-ab84-41d7-9018-44d0d5e73dcb", "value": "T151E412D727AB8F17D8B99FF1F12040520BB1612F6222E2C94DC93CFB94B6B930A51657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539265, "uuid": "86819f42-8854-4170-9105-49a4ec0d098c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539265, "uuid": "ce934a4b-28d1-4172-adeb-43724265bb95", "value": "12288:8g6SKlpxbeSZIfRZEQfTVXSeI84w+UxbCcGhyLEKJTGLt1c:uLlpxb3IJ6iFb7xtsypJiLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539265, "uuid": "598e900c-78b6-423d-930a-d72e228dd17a", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539265, "uuid": "67250a55-19cc-4857-ab5a-73270380997c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539265, "uuid": "6158f072-4c37-44d4-9f4a-4c78718cf7bb", "value": "DHL TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cc1ec1-12c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659485877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659485877, "uuid": "efe7221e-6b77-42ca-b5d9-262720f013d8", "comment": "Malware payload (AgentTesla)", "value": "a2038f5da3368563d2da885253388931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659485877, "uuid": "f9ca9573-ba63-4071-a06f-e526fecedaad", "comment": "Malware payload (AgentTesla)", "value": "1b20058d409401ec6f8d69953d50d25e651b5684a093c9f2a2c2e61cf5646864", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659485877, "uuid": "63408550-1ba3-47a2-9af6-d8aaaa33ac36", "comment": "Malware payload (AgentTesla)", "value": "044597d1acb6b28b6825407df0ec4e65a11745b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659485877, "uuid": "3549fb9f-ca3e-44d4-96b2-f6ebac0bd640", "comment": "Malware payload (AgentTesla)", "value": "dd45bea562eeaf43630a4f185a55d6c6965aad416e44ad62f930147ba9fb6a89907755af51e7f7bccb21050f2772f0ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659485877, "uuid": "e6cc0f9f-70da-4fe1-a047-ef286316da15", "value": "T109E4F169326FDC13C2391F76D0C1401007729A5B9611E78B7FCA35FBA9127EA4E94B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659485877, "uuid": "d80466c1-9db2-4245-8d48-e544e4ab7696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659485877, "uuid": "c40c62d7-7a8e-46a9-bef8-da9d2360645f", "value": "12288:wIn9teNQv43rg6SKlpxc4WbvIYnUqD3v5N338ge+faele76/fglHbc887tWEoE:ziLlpxc1quvX3S+pVq7c88ZPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659485877, "uuid": "f1693520-91a3-465c-98ab-0623a6067768", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659485877, "uuid": "cc2bb8b2-a49e-40b7-9f39-78f4dfe36182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659485877, "uuid": "c2788406-39eb-4d6a-ac5e-93e48243b63e", "value": "order 00041221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5545a8bb-1314-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659521356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521356, "uuid": "04314102-f86b-4af8-a0b2-227781a492fb", "comment": "Malware payload (Formbook)", "value": "a69dc7c80e6ad4b3de99dd56204ce64b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521356, "uuid": "9c235519-c525-4a57-a2ff-8908a8c857bb", "comment": "Malware payload (Formbook)", "value": "1b40cc7a99e0c4e22422b5c78c8a32496be11159c5fbb49e525cbd4c0e43a916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521356, "uuid": "6dd0154e-8988-4fae-bb56-792a0e6da060", "comment": "Malware payload (Formbook)", "value": "d3bf2613278a93ca87891ddf3b63b9d771d8e666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521356, "uuid": "92c12f17-205c-4abf-aa3d-a9e143e5f8b5", "comment": "Malware payload (Formbook)", "value": "731d2a91d8dd8ce982a8678e8a5a81b562ac0d0026330f548d7b3e0ee3b64db3bb780f39fb0453bce762347a5495d76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521356, "uuid": "a15d2c0a-94f2-41c4-a3bf-fc1eca1ce320", "value": "T18EF401C365EA8A13F73A5AB5FD21400557BA6E6A0022D7A88DC9FFF750F67430E24253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521356, "uuid": "f41b3051-bea9-44c1-8db8-7b9cdf3345e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521356, "uuid": "3fa8bd63-8181-4607-a587-0b270fca6c83", "value": "12288:aDWg6SKlpxExzAWVvRrEl1ICDj/WMI2ov0IzTa0d70LSexU:aDELlpxEpVtE1Dj/A2xaTag7YSeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521356, "uuid": "d7b03c1b-3aec-44c6-97f9-b7f9036afe43", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521356, "uuid": "c19322b4-aab8-4412-b6c9-d77cf4bcf6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521356, "uuid": "f5bc0702-f81a-4dc6-97ac-c522861ce76a", "value": "SecuriteInfo.com.Variant.Strictor.267077.25143.9539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64828fe7-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Hive)", "timestamp": 1659507638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507638, "uuid": "8910748e-0d49-4808-b3a9-2ce6994a3068", "comment": "Malware payload (Hive)", "value": "d535fcd944270da75c9882e1204f1c25", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507638, "uuid": "3ca1fac3-7ef4-420b-bcdc-74c5998d7c2a", "comment": "Malware payload (Hive)", "value": "1c4dbb8e28d0d219785c45408548ce15cd92c032f2a20f5f5c32e1d12eb50509", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507638, "uuid": "e7de6f8c-b106-444e-8f57-d7feb60abfab", "comment": "Malware payload (Hive)", "value": "63f6365a0438f9f36f94dd00ad9b894b4d89517d", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507638, "uuid": "91a58f17-81ab-43c1-a74e-6ab9da068851", "comment": "Malware payload (Hive)", "value": "6b29d4ca2fa6a9f59a0bb1c8f0f38fad7473ea9f376052d77194e531145b47e157ddc6354c38537ef91d70b082ca1887", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507638, "uuid": "9f7380b1-3c49-4952-b0f6-e4c8bd0e6e79", "value": "T160C57B03B89469B5C5AAD23189B58292B630BC490F3167C73F54B7BE2E73BD45E38394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507638, "uuid": "bc4e4c1b-8aa9-4a91-bd2c-fe100c35494e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507638, "uuid": "604e0c1d-3597-4d5b-b8c3-fe238135ae62", "value": "49152:vsk3gjrb/TnvO90dL3BmAFd4A64nsfJO32igQrBk1FyQgyPD1artpavVktE69Kj:v3gptyYRYtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507638, "uuid": "05e28bca-3800-4821-9074-e888addc622d", "value": 2645504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507638, "uuid": "14698c75-d048-430a-85b6-67147c1d2242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507638, "uuid": "d5e8a2ef-ffc2-4d6d-ac8b-897d9560d8dc", "value": "quietmoth.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3994a11e-1315-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659521739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521739, "uuid": "10d3b400-28e1-4f45-8b94-319a0a16f979", "comment": "Malware payload (RedLineStealer)", "value": "077b981ecfe998a0cc9c74cf1f7bbcf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521739, "uuid": "31dd009e-aacd-4212-8fc2-ab2cc3470e05", "comment": "Malware payload (RedLineStealer)", "value": "1d300f792a31b06e6d1825396d1d48350d5276c5bfebd8609191d18c4d8820cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521739, "uuid": "45e1ab1f-6cf4-43b1-b70a-61a22a75b2b8", "comment": "Malware payload (RedLineStealer)", "value": "728c700149957df32f31b2db5a893a12f9d938be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521739, "uuid": "695c7315-53dd-4b74-abfa-e3a9cb1d676b", "comment": "Malware payload (RedLineStealer)", "value": "541e35a2eee52eb16c3da5a1f163f212e1ebaad9e4571f15ac8d1884f80b4337935a0ea7c987d7e4b95362e2ccfdf08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521739, "uuid": "4a2b7023-5193-4a01-b31f-0682051a7d11", "value": "T177A35D3067AC9F19EAFD1B75B472012043F0E08A9091FB4A4DC194E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521739, "uuid": "e63ce433-2662-4d3d-8128-0b482d0e269a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521739, "uuid": "db5b8c22-fee6-4cd4-bebc-dca71ebbce5c", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2QtmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521739, "uuid": "500133eb-06dd-4943-8f9a-936b822e9511", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521739, "uuid": "c2f0fd3c-510e-4889-8b4c-8743491164a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521739, "uuid": "35bf989c-bbb5-49c6-a4cf-cb928e304f0c", "value": "1d300f792a31b06e6d1825396d1d48350d5276c5bfebd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484a6d02-12ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659504155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504155, "uuid": "9dfa57a7-0b6f-423a-854b-a32063e19aa3", "comment": "Malware payload (Formbook)", "value": "be59942a4e10032c7190c7d3a4a38783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504155, "uuid": "02be725d-258a-4fa8-a1fd-c669df48dbc1", "comment": "Malware payload (Formbook)", "value": "1e2e1fecda1667f10e086d9f86458dadf8ab19874abf16a36e669a6c87d845e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504155, "uuid": "722acc07-d2af-484e-959e-ac145863d7bf", "comment": "Malware payload (Formbook)", "value": "a136662eb0ad45112d683bd964d26856c240b3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504155, "uuid": "338d84c1-d74d-438c-87fb-27daebf29507", "comment": "Malware payload (Formbook)", "value": "62afc76a5f1ba7e42d949c34b12b4d93f678e0ec2aab37a03963d2bbf07a4128acf0a31bceefba1cf3746ef397155d1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504155, "uuid": "d971ebe3-3b92-4cd3-8087-fd0dfaabc96b", "value": "T169C4E07759998A7CE220C47892DF333064505F2EAF869CAC77764EEDB340A4F4891BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504155, "uuid": "e16c66d0-9c51-4645-847e-ae601e170422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504155, "uuid": "61bcb9b1-f760-4329-8567-6cc2922be5ad", "value": "12288:5eOuzmbjM+aEmOj7fin9gdAym7QVdOwK/xa5ELJkmw:j0mbuEV7fin9gBwQnK/xa5Bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659504155, "uuid": "4259db5d-c7ad-42d2-9e4e-0cbc612876f3", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659504155, "uuid": "05eeecce-1f59-4d12-b851-4766650ddd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504155, "uuid": "048ca129-0c6a-426c-8f17-1acd2f3d4eb9", "value": "Glxfra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460d524d-12db-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659496850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496850, "uuid": "f78440ca-f9b8-4bce-98ae-2ae1754e86a5", "comment": "Malware payload (RedLineStealer)", "value": "2985d927424741f025c128a5dfafbf18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496850, "uuid": "0a8de74c-b913-473b-9c24-36249bfb62ca", "comment": "Malware payload (RedLineStealer)", "value": "1ee90f855174d9f4106ebcb4ced163beea30035159354f08c83f5b1b0793b425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496850, "uuid": "775d435b-cc97-4440-bbab-31cc9bec4aa8", "comment": "Malware payload (RedLineStealer)", "value": "adcac2d575727a131f17418d4d4332b6238867a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496850, "uuid": "ced79875-6cb6-4fc6-a482-684707f24dea", "comment": "Malware payload (RedLineStealer)", "value": "05f0abeaace064e01ff21097a081531dc0e5e0bf5022defdb8f7f2e45019481bc85cda18b9a58e57ccf9e369a2d81e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496850, "uuid": "07859aab-bcb4-4515-90d1-22a22d7d759f", "value": "T1C6C51B136A8B0E75DDC23BB461CB633AA734ED30CA3A9B7BF609C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496850, "uuid": "888f0396-58ea-45f6-b012-05414a863e92", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496850, "uuid": "23930a10-468c-4d6f-8a1a-4ed6475a0152", "value": "24576:nrZvq0sFgXJYNYdTf6XiXMCLdrWYCYKozdwT4TEqpFck5LJY4dWhl3RuQ55313h:nhq0GghbrTEYFck5lRsl3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659496850, "uuid": "b1d900f9-6a03-445d-8c0f-ef17014538ee", "value": 2593344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659496850, "uuid": "324c6053-a635-4c8b-8a5c-e90df413ff2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496850, "uuid": "58bc7291-5dae-4a18-8d42-bce84774f920", "value": "2985d927424741f025c128a5dfafbf18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5c5d21-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542707, "uuid": "1129c819-555a-4668-a0d4-01724bc9bde7", "comment": "Malware payload (Mirai)", "value": "d92873366b73e0c8b3db199e3ee62412", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542707, "uuid": "dd03298f-5882-4aad-ac5b-bc86f11b22f2", "comment": "Malware payload (Mirai)", "value": "210e7a04a9ad77dc015bd21cb22af1aa07f6e956cf073fc37342cddb04e91472", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542707, "uuid": "0e0be257-9bf2-4cd5-af7b-b83620ceb947", "comment": "Malware payload (Mirai)", "value": "816f89f9799245d57ce0ecf43453b66580b38294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542707, "uuid": "5bb8d1a9-9c99-42e2-894c-bbc80e7aa4ec", "comment": "Malware payload (Mirai)", "value": "292f1d4303618d8759cd5987a2daf00806e9a68ac7d8a83e9851d3899e9598ddea941cf0ca775d0b23ed19d5b8ab35d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542707, "uuid": "bec5b1d0-2eec-46d9-b16f-436cc1d56423", "value": "T17E330A9AB8029D3CF90FE6BE54164E0DB93177C152830B2767BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542707, "uuid": "b7f1d655-f20e-4d53-820c-00a9058313d6", "value": "768:oBCP9hTzoEWRcqOCLuYUc6xe+Tm806Msq3zkHQXOZrupiQG/:TX5qCYWxeqm806M9kHQX0rui/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542707, "uuid": "416b925b-7624-448f-bd82-b748cec287d3", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542707, "uuid": "a8cc32f2-a062-448b-9685-04216072b6bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542707, "uuid": "f2fabf1e-20f8-4e21-b662-251b2f9a34c4", "value": "d92873366b73e0c8b3db199e3ee62412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a157d5b-1319-11ed-93bb-42010a9c0043", "comment": "Malware payload (SocGholish)", "timestamp": 1659523593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523593, "uuid": "5cffbbfd-db25-4dcf-8837-d9198ef0b838", "comment": "Malware payload (SocGholish)", "value": "88e9bae8fa86b37bfdf6a337f0ad0e8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523593, "uuid": "c16d7dc9-d2dc-4be9-82d8-aa1f600f0121", "comment": "Malware payload (SocGholish)", "value": "212c125c1661f121da8f8719feb42d49f9bdd3552fa3accc71f7e1ff9650172e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523593, "uuid": "38fefc1f-dc66-4698-9ad7-64be4e221cf6", "comment": "Malware payload (SocGholish)", "value": "a6fa294c76092e8ed99d12eb439b659da391f09a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523593, "uuid": "80d6ca47-8393-40d6-81cc-bfb4c8e4da8f", "comment": "Malware payload (SocGholish)", "value": "8714bf4eb8bd1c7dfad825821f13c52797738f4147058682299527d5f1258a95756238a3691aed4c98038eb3896b76d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523593, "uuid": "a6fef737-10fa-4597-8800-4a4116510da8", "value": "T1821161210EC5826F4E3940A3C40F8D28521219024E8C74648282E5B4B9C5B78B3B97A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523593, "uuid": "564e3fc1-9aeb-48a4-a81e-e1250c75bf05", "value": "24:PCJXLHRBIwEaBD8TJfHYgZja3yHTv4lfJCKPtH1u005:a5HRBIwEaSjaCzv4XCKju0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659523593, "uuid": "8f494415-86ca-4667-94df-8e72e6493423", "value": 962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659523593, "uuid": "b72a5d62-2601-4538-b4b4-276a9d2da665", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523593, "uuid": "2a72c5a5-3501-4859-a096-0d0c95f7d541", "value": "Chrom\u00d0\u00b5.Updat\u00d0\u00b5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbf56fd-12f2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659506878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506878, "uuid": "baff258c-2508-4e7e-ba29-fca23cc81254", "comment": "Malware payload (Formbook)", "value": "020a0db72f3ddd0153f843e4811fb877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506878, "uuid": "fe5feee6-3e0a-48ce-9384-ed0251f798a5", "comment": "Malware payload (Formbook)", "value": "226abb03563c18970c9c94a4ab6e348d635504ae596a6e52b08d200eb7aa9b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506878, "uuid": "dafa0467-3478-45b5-b822-6ffa139eb9b2", "comment": "Malware payload (Formbook)", "value": "542f9b4088cbe77d6adc80dcf1f59a0b2f4cef58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506878, "uuid": "9d8988ce-9dca-414b-8cc6-3b44d0850ac7", "comment": "Malware payload (Formbook)", "value": "8039452c5eb39623a5f25fc54097d346dbb985219a72d54e74c9fa1feaab802a3ac1992b4e5403e7d16b1d25581b5cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506878, "uuid": "5297c227-68ae-4c3e-9d2b-8c0829e46bd0", "value": "T15663E79CB790798FCC6BCD72AEA41C28AB20B477531BC253E453519C9A0DA8BDF151B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506878, "uuid": "17d452d6-3d3b-4322-b411-deec82f1c738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506878, "uuid": "1d234eb9-b747-4799-97f6-7c576e0ebe6a", "value": "1536:L+7pkJCYNdQaolLEa7KRpmwIo9t24iLgWC:L3JpN2aoqaqTIQt2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506878, "uuid": "53aa15f0-f13b-4068-b393-3ea9e416f496", "value": 69152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506878, "uuid": "86a8c911-c98c-4cf5-96a7-5aad74e0e677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506878, "uuid": "03597cff-48ca-4d04-96b9-218e01593967", "value": "DHL DELIVERY DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fced22-136b-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659558635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558635, "uuid": "a35795c6-822a-4a12-b85d-3aa91f95f719", "comment": "Malware payload (ArkeiStealer)", "value": "17ea9707608c048bbc933e8fb365d483", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558635, "uuid": "9400c02a-adff-4e04-a8bd-b7770b86a282", "comment": "Malware payload (ArkeiStealer)", "value": "22eae9c51337fd8dc6d1bb281a6e1ddb9990d906076cb3e1d89887eadbdfd374", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558635, "uuid": "021de30d-8a41-4057-a0b3-3d58e44442cc", "comment": "Malware payload (ArkeiStealer)", "value": "430c8d8bcf6d095903ed3c1dcfe70a4a5cda32a1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558635, "uuid": "254a6b33-abda-48d4-8f6d-ea0281a5bf0e", "comment": "Malware payload (ArkeiStealer)", "value": "172098905d7012db195587cc1e2e3eaed9db11610264c9f6b6fa4372933581f12218d60d5b973eed39ac72f17167f37d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558635, "uuid": "f269c2c2-275a-4731-9739-4520045d2d14", "value": "T16204ADE176E0C4F2E1A729304878C6B16AFAB8226774858F3764072E1E617C15E3F75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558635, "uuid": "d7d7c7a9-5e0a-40c8-a7d0-63aa643564f0", "value": "a8692768e915e3ee244bd5d51d7bedfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558635, "uuid": "8de105b6-fc7e-4f67-b77b-194d26f6c949", "value": "3072:wt9mZrSPd07P4SczpIiDi1QaC5ydjRDMzbh71CL2F0L:wPmZQd0T9w5m1QTMNMzn2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659558635, "uuid": "42cf72f6-0560-43ba-8713-6c965f8c286e", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659558635, "uuid": "966f34e7-2e31-4219-9778-ebfbfb4bb020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558635, "uuid": "b5789eb6-bc4b-4826-99c5-316e9edcbfbc", "value": "17ea9707608c048bbc933e8fb365d483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5830be8a-1386-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659570324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570324, "uuid": "5a072c53-4e47-4d45-a021-5f03bd44f652", "comment": "Malware payload", "value": "235414b38f9a0ffa00c80cec666a2803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570324, "uuid": "cab0de47-c407-4e97-9837-0defb7b1db8b", "comment": "Malware payload", "value": "22f9a7a8f42d3d3c49c8868d8013d56e54fcdcde9c020fb03bad42903f77279c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570324, "uuid": "50ff509c-a63e-450c-8936-4fbb61e5ac0c", "comment": "Malware payload", "value": "0ccac76084ff79e1518f82415916b523e357aef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570324, "uuid": "1d038a24-3963-4682-b47b-5784c7e5c076", "comment": "Malware payload", "value": "5e3cdbb32d4e303f0d162e767f98bd057fec6470cbd0b83faeff818240a17a2071e189ebe9c4427db8460f04a17c35d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570324, "uuid": "ad2469d4-f88a-4f23-87bc-89e099438178", "value": "T12BE32158D5485FD5E202F638E5F8FF1D06108FA6B22EAB48D471B94278727CF2466C8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570324, "uuid": "fb2fca7c-5513-475f-be14-452d6deb5581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570324, "uuid": "04b59c51-3155-4e59-a07b-30714ba14040", "value": "3072:/zZTKoFmIZ3inqhqXNoI6aDpj8xRbRBczSon0BZxAmXkLM657Z6s1OKhSt6WVN2C:dTKu1gRtv6cWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659570324, "uuid": "0c211732-97a8-4337-9399-36a984a35d49", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659570324, "uuid": "a854636a-e75d-41e8-9cb5-d4c110cda921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570324, "uuid": "d17ce27a-cdb4-4565-a44f-e112f166ec79", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17067.1025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2eb5ab-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495093, "uuid": "b5a4f51e-bfe1-4742-a57a-568acc230d47", "comment": "Malware payload (Mirai)", "value": "1146e91af9266c3c4dd6d29dad2c2a1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495093, "uuid": "0ff55e4f-f864-4038-b234-660996c20c79", "comment": "Malware payload (Mirai)", "value": "23d07a2e171c54e770ab52171309e699d69ec1b0b50094b44e0682c3ec85eacf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495093, "uuid": "96552335-4bd0-410c-a4d9-33b05418d011", "comment": "Malware payload (Mirai)", "value": "86c29e26516f0b0bdd06246f7e38a12d4d61decd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495093, "uuid": "4f08ce41-9891-4117-9115-e9c3653505a2", "comment": "Malware payload (Mirai)", "value": "49b01ed4a24b5a229757c3f425837340c8c5de2bda372ccf525fba9c7a140c5c19635ac0f1e3c1ea839c4e9c5ecc0b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495093, "uuid": "93a0f83d-0812-48b5-abc7-40f3108081d8", "value": "T1B7B2CFDCA1543084C98D6C7C2B8D4A664F6CA0D0BAEDDB19E360CE9473BAA4B385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495093, "uuid": "23cfb362-a5c1-4bbe-99a9-3bc9f1afc2d0", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpTfZqSWvJ:4QlS07FUXqIYSXQKqulqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495093, "uuid": "546cfbf3-be87-4166-945b-8bb6836d4bb6", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495093, "uuid": "34394808-3769-4d4e-9fd1-63b10ae3b3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495093, "uuid": "2b62eae8-f577-474b-906a-8a594862f32b", "value": "1146e91af9266c3c4dd6d29dad2c2a1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d5248b-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (TeamBot)", "timestamp": 1659513944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513944, "uuid": "ebc72cbb-4cc8-43ce-b435-dead28b33791", "comment": "Malware payload (TeamBot)", "value": "93799e22d1a86e30be05fbe0b39ede40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513944, "uuid": "dbd13a53-2474-4ece-9fdf-54e8b52fee51", "comment": "Malware payload (TeamBot)", "value": "248ee491268455c00f934e8867fbef87e4b756c8a0004a9e580d575c5793f6b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513944, "uuid": "eecb0550-f9c1-4e2c-ae08-c66e0269a35b", "comment": "Malware payload (TeamBot)", "value": "a8ffe117a63f85e37309d52060efcba8fb53d713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513944, "uuid": "0ff9d158-0b65-4579-bcaf-81c34ac96f81", "comment": "Malware payload (TeamBot)", "value": "9993ba05320fc4b6fecaf8d9d484d45501e5b1dabf11aa9577f0477d56fa321c3468b7c5286e50c7e8de0c99ec1893bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513944, "uuid": "2939fc3e-e913-40c8-9dd6-126ea7e72552", "value": "T122E41211B6E2C433E5BB217D48B4F6A54A7FF4231A72DACB33A412691E756C16E3430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513944, "uuid": "2bd5d253-1d47-41c6-bff3-c7ef88465938", "value": "16efb6b0368de80f5b2f8ee7ed5ecc80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513944, "uuid": "b93eadf7-eb2d-4ab8-a34c-a110d745dfbb", "value": "12288:amFitxTRuYFJ6I/a8Z18XTOvyNVPPvMNGFIaLpaiNcGSDz0Frd5jx7js:amyK0GC6TOvwVPdFjLptN+z0H59s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513944, "uuid": "30fcefb4-7e45-4883-97ca-92a8eb752ec1", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513944, "uuid": "40b3051d-b02f-419b-81e0-db35a9f9ecbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513944, "uuid": "0d06c24f-b530-49ce-862b-9a8f7dba1ccd", "value": "93799e22d1a86e30be05fbe0b39ede40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8618852-12f2-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659506920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506920, "uuid": "bd65628a-244c-48d3-944b-ebcaa21ed956", "comment": "Malware payload (GuLoader)", "value": "0b3a0090137cfccc211d0b72e1e2d22e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506920, "uuid": "cc966088-ea88-4755-bf87-588c4df8d6d8", "comment": "Malware payload (GuLoader)", "value": "24f8c465992b6f784917318ab23c0079b70b3c5b5e666f938a31a7d214978425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506920, "uuid": "d24f4c69-9cfa-4a94-b345-140536718f43", "comment": "Malware payload (GuLoader)", "value": "2c3066c46c38ee9137f4cd9742b898ca471f9641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506920, "uuid": "75721396-0375-4b69-8708-834b3d4e5876", "comment": "Malware payload (GuLoader)", "value": "0fbff3bdbbe15bc14ac5b55f99dbf1ff225502f45964cfde3ed5d80cea49c3b4a0cbe7b8e0e09a770529eeaee2ff4463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506920, "uuid": "8f8146e8-e6fd-4021-8285-3f1dd2e2ed1d", "value": "T12614F1092B62C293D5420E71197ED6336EB9DF06286B270F33906F5F79327508E2E796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506920, "uuid": "5c4a34c9-5b43-4281-b606-d6f2c6fab02a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506920, "uuid": "ddc9b916-da80-4b55-b5ed-7033cee9fb64", "value": "3072:2fY/TU9fE9PEtu8heoYjXqbM/tStUy4m0RKNijuRci4LwOenyDw+mhPvNKz4mURp:gYa6ihk0m4DtSW39iwtEAtNKURUxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506920, "uuid": "025d1c74-da34-41db-b428-fda64eb41c4b", "value": 204112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506920, "uuid": "b8d69d2e-c794-4a6d-b632-ef68bab8af3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506920, "uuid": "69fa4a34-0963-46b0-9fae-fa415883a3d0", "value": "Lithoprint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17ad8a8-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507740, "uuid": "a599ed64-f7c3-4566-86b1-7948af4978da", "comment": "Malware payload", "value": "dbad54d41f4e3bb1341cac986a38c62d", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507740, "uuid": "02046303-55ba-45af-8908-5e5957504ea1", "comment": "Malware payload", "value": "265cc3db46cf8eb851a423f975ca0b0238dc283949a544a69f96a0c09b5a658d", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507740, "uuid": "fcd19a47-5538-4c10-a2f6-cf5500e06bc0", "comment": "Malware payload", "value": "456fc6db8ab3478de935475c74a262499cf10da6", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507740, "uuid": "876661ff-95a2-4a95-a076-d96ed06a9b5b", "comment": "Malware payload", "value": "a05f42044d61983baa7983dffbe67e2982696a799b1a3a689d18912b85d69ed5b7e418283bffcecf1fa7a6a06d2e7164", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507740, "uuid": "feada571-7706-485b-8281-6354d89d032c", "value": "T164126D2AE152FC5CC1338E7E850800F3A28E15527D8677DA745ABA4F274A2D357CF558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507740, "uuid": "9935cc3c-732d-437b-8f80-39ab5cf89b6d", "value": "96:1ji4p+IWUgqq39WE+CtV6BB6GaP9Ul+c6+du8jf6UWTVUwhz/DXnYSJLqZbMX4qV:/mJR3eCTeaFUlbVvevUqzrXjJ+C4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507740, "uuid": "0a7c1118-3a06-4d71-bfac-ddeb2cf31c17", "value": 9394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507740, "uuid": "6fbd1e8c-ef84-4918-a213-c5d78418fd57", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507740, "uuid": "0faea89a-4b90-4fcf-b06d-d085bb6b361e", "value": "report-14.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7675c3e-137a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659565383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565383, "uuid": "27900299-673e-4215-9e07-2b68ec42ce0a", "comment": "Malware payload (Loki)", "value": "4bac42fdc2e777c0308900f6931c76a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565383, "uuid": "f2eb1176-3f97-420e-8b2b-b82a173e4d31", "comment": "Malware payload (Loki)", "value": "26859dd19c5fdc667283adba1b6f9c0e7fdb81af461857a98d0561ec80620ee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565383, "uuid": "9c968d3c-ef57-4574-8c79-286b3ade5682", "comment": "Malware payload (Loki)", "value": "d3bd2cb7b1026d4958dd38ef2d37764ade7ab414", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565383, "uuid": "bc237551-c6e0-45ef-a62e-05dc62265a56", "comment": "Malware payload (Loki)", "value": "a1a12db00ffde88e49f33dbb68843f174eb1a79878fd4bbcb31726845235f436cfbdab05db47f0df786699309b9aed7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565383, "uuid": "20e0b600-d3e1-4400-9acc-a307a605769e", "value": "T16DE401A773DE8B03C5358F7DE04A1DE1832AD17E6321E315ADB93ABBA5933054220B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565383, "uuid": "b76b532d-ec2a-4b64-a333-5731b181ac83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565383, "uuid": "14859ab9-d5c1-4289-af28-f8f02ae5133e", "value": "12288:DFdSACvg6SKlpxEL69yn7cOERg3nRBbGySfuGq/0h9bCxkvSWUsyDhxOSpo:DFdSAaLlpxEQyAybGY0h9b1SWWD2S+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565383, "uuid": "fa58411e-9211-40ce-87c1-e6e1b3757cd3", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565383, "uuid": "ee7dc0a6-af15-4414-af2b-8ac75924932b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565383, "uuid": "1332f309-1ccb-4d4d-aed6-62a1d33d18b3", "value": "4bac42fdc2e777c0308900f6931c76a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba36b15-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659539138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539138, "uuid": "c12df491-c368-450d-bf4b-653ba4d18ed9", "comment": "Malware payload (ArkeiStealer)", "value": "c529659ad79b58eb83d1732b6cc88ff5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539138, "uuid": "6d822b2c-35b3-4eec-870a-0e5ed1dfd888", "comment": "Malware payload (ArkeiStealer)", "value": "269200ba6acb859b712185ebdad2b0000333e42d194e05d12d86eb3590125aed", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539138, "uuid": "54f85a6a-870d-4e2b-818d-bd24c0cb7c58", "comment": "Malware payload (ArkeiStealer)", "value": "aad399bd653192ec0ecdeac5c1a4cbf43afb19b6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539138, "uuid": "52a1e9e7-cf2c-43c5-b6c4-f6d0368b4753", "comment": "Malware payload (ArkeiStealer)", "value": "e5a5930629102bb5a177b1a241452d981354c35fa3f4073df5026f33e7e89acf061d31669854b55a951a81553b35de97", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539138, "uuid": "11093367-c5c6-4c82-94f9-ddd75baa21d7", "value": "T14A04AD2133E1C072D4B729309B75DAE15B3AB922E7B45B8B7760072A1F712C1BA38757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539138, "uuid": "9cbfb8c2-dd70-4a50-855b-872aee8111ca", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539138, "uuid": "f7130c10-4b34-479d-8de6-57586f0d18ed", "value": "3072:C196SvSbCDBMY3ue3PFUt76X9JfIruFeKQvd4xkESjMWD/Y:CVcmhfW6X9OihQvDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539138, "uuid": "7e4a3d44-b262-4e92-9358-eef61c188219", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539138, "uuid": "2643a93a-d08c-4c93-9fb4-bcad5698fc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539138, "uuid": "1996165b-40b6-437e-8d9e-726734f7e88f", "value": "c529659ad79b58eb83d1732b6cc88ff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a29e16-1375-11ed-93bb-42010a9c0043", "comment": "Malware payload (Pony)", "timestamp": 1659563119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659563119, "uuid": "a491989c-0d26-4e07-8235-a6530ca08f12", "comment": "Malware payload (Pony)", "value": "409c85403c102a38e60aab80ee33fca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659563119, "uuid": "89a27b96-27b5-4e2f-aa38-cf8006a0d656", "comment": "Malware payload (Pony)", "value": "274f0116cb75f8f435f090ff1694fcc0674a77f1a810556bdd984dc82c37bf48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659563119, "uuid": "014d4ccb-015b-4a3f-9e3a-a5a69ec8923c", "comment": "Malware payload (Pony)", "value": "a56679a926807454ee47746342ebd41aacbe0cff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659563119, "uuid": "9ecc08da-289c-410e-95a6-980824cbac94", "comment": "Malware payload (Pony)", "value": "e925d8f183e53fd8327925a5a01058b593b3bdccc502134c601a7ca2fc4e3430583dcf962aebd31e9e2f79afb335ca94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659563119, "uuid": "6f939936-d1d0-4473-9c88-7d9002594a92", "value": "T189F2F127377FEE72D9CB143BA0429650BA4F90B01C505B83095CEC6FB0A46DEE473AA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659563119, "uuid": "d8e05856-e707-478a-ac84-5ebc1d014a69", "value": "df73209c8e0304ba710921b67130b1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659563119, "uuid": "4a15c4e7-071a-45f0-92cf-7254e950fdef", "value": "768:renmd9YYTwgwOnSU40bfxpnM7vPJEiEC+acJUs33:resYYPSS1MLPJE7ayUs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659563119, "uuid": "05463295-a693-4a9c-a655-3574b1a16d1c", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659563119, "uuid": "ae9784d8-34ac-47a9-ad6e-5faef44965f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659563119, "uuid": "f720b45a-b43e-45d0-b7fa-6b49c8a4b87e", "value": "409c85403c102a38e60aab80ee33fca2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9f0898-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507677, "uuid": "b849e9b4-8016-4429-931f-b99a23d43e0d", "comment": "Malware payload", "value": "326af9d79b8683c3de40c5e6233364b5", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507677, "uuid": "9863cddb-0d8e-41ec-b7df-5486ab06919f", "comment": "Malware payload", "value": "298855399689be4ff0d418295f5f4a0b4cc671f8556c7fd36ab79d4d10d7868e", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507677, "uuid": "070f9459-0036-4d20-bc5e-5e6e3fb3962d", "comment": "Malware payload", "value": "6f13c9c0ce4cc9bc54c57c1e5dc8f2337d60a658", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507677, "uuid": "7f4a829e-6096-40f7-9897-a7386b6f70cf", "comment": "Malware payload", "value": "9a918f535dcbe659033a032ef981072863afd52a192f08e223f33975a173543766044d5b4cf794b359779232d464b4fe", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507677, "uuid": "c3736d79-e6de-45d9-917b-88f5b48c67d8", "value": "T194F27001B3DACD27F05646314DD7D2DA767ABC5AAE06C30B32443F2EBC792709A15B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507677, "uuid": "b12d400a-819c-42b3-a6a8-f32bdaefad13", "value": "384:1U8iSsqdg1vA97PhMv1NRZ0jOPttLSzrV01a:1p+1o9d+r8zrV01a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507677, "uuid": "123fb228-51f7-4d0c-9260-16b4f3611c43", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507677, "uuid": "b516754b-74dd-493b-8be2-7b2c433b6598", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507677, "uuid": "cc816263-16b3-4442-b3e4-5f9f714a81ea", "value": "macro.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2735b07-134a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659544813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544813, "uuid": "cec0a02b-cf3c-48f2-bf29-6661b5269f37", "comment": "Malware payload", "value": "c2d2b929996a9dd5c6e6c064c0435aab", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544813, "uuid": "de30a772-dcae-41ff-b752-7755a2168d8b", "comment": "Malware payload", "value": "2a1346f21ffe0eb4b5525076bc3292b385e837166b6baeb70326bf32604b4dcd", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544813, "uuid": "ad2a9d0c-e255-499d-bc07-7e2fcd6a7280", "comment": "Malware payload", "value": "8493e91deed900cf3c72d9fca2e14f11030a9d78", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544813, "uuid": "ab53abb0-1276-4948-b57f-765e8bb3e1e9", "comment": "Malware payload", "value": "56acae6326456d06352341eb35298e0f3bf01ae0f4c9d2f37c9407abd3657d3809f8f2c5365f690cde069ed954f5ee25", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544813, "uuid": "55417b37-c093-4e08-8d35-43671ea65afb", "value": "T14751851AFD4BD14CABB9236BEDC78622FF1B801B5DA2104875DCD2491F30809A76CA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544813, "uuid": "6845c951-8de9-47bc-9929-f1d0a5041e4c", "value": "48:Ap48OjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQBozl4X:AWChrffoypvK0elkEYZa5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659544813, "uuid": "5b522794-afd4-49a4-a2be-f7c22b13c720", "value": 3161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659544813, "uuid": "8c4ff70c-5695-45bb-93c0-69fa9b6a5a46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544813, "uuid": "6d3f8ade-c4a1-4798-a142-2e5836f9c9b3", "value": "cnXn6tZk.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58160da-1315-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659521947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521947, "uuid": "94ccf2f5-f6c3-4f23-9cc5-dd17cbd1cc43", "comment": "Malware payload (SnakeKeylogger)", "value": "3411a52eb10cb4331ec36b7398f4ed31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521947, "uuid": "9ed8cb57-3ba4-4c3b-a1b4-7d93f14d7f01", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6f6ba520ffdc9cb2af378b87bd4a10fe21287300b2b309893a55cf48a71520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521947, "uuid": "a2772c69-7688-4b02-9004-943948dd3914", "comment": "Malware payload (SnakeKeylogger)", "value": "1d2a56888fefac8b22e474f51abca7a87298018c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521947, "uuid": "a4c2021a-d115-4dd9-ac91-3ad8a327b69b", "comment": "Malware payload (SnakeKeylogger)", "value": "61890b010ed035eedf682266b1c3c4f5b471f81ddf08882d1c64c6c74742568463af7eea0a9b13dc260d2258726e604e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521947, "uuid": "9882d685-c75e-485b-b8de-e0dd4b93104e", "value": "T1C7E4128632BB8F13F8794FF6B55150844BB0963E5423D28D8E8A7DF3AAB63074B50553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521947, "uuid": "9c3eb3db-dab5-4a18-a85d-a36f45d94d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521947, "uuid": "8698ebfd-9f3b-458c-bc85-0d5c110d156d", "value": "12288:fg6SKlpxdc1al4o9FW/36/c0YU4mk5+hC5TRNoZ:xLlpxdJl5xcIW5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521947, "uuid": "10a11794-f120-4b9e-8143-9da08ee15ab3", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521947, "uuid": "31f9046d-620f-4a66-8695-6fc40efb892e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521947, "uuid": "1ed9bee8-0a75-4d4e-812e-0824108fe6b8", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ea7bfd-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Metasploit)", "timestamp": 1659507669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507669, "uuid": "e9d3b116-0208-464f-933e-fd6165126eb0", "comment": "Malware payload (Metasploit)", "value": "2e2c1d6ad0382323610eb34e4e07497e", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507669, "uuid": "260376f9-f2ed-4edf-a202-13930a785f87", "comment": "Malware payload (Metasploit)", "value": "2a9a1d0c0fff5c866b9e3615737f69f73e14212db2e4d86ddf635b200aa824a7", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507669, "uuid": "b49e03d1-b2de-4e2f-a914-c0e724281206", "comment": "Malware payload (Metasploit)", "value": "d757289ec35656bfb343bc00c74b4b3d892ff521", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507669, "uuid": "ea273d85-3210-4725-83a5-9e56f47467bd", "comment": "Malware payload (Metasploit)", "value": "1bebbbe9c430f70c36a2133d9c409bcc239fda3d53634e7dd68b2062c32eba76a16a238d86dd12db18a1e1b03dd0e38d", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507669, "uuid": "3c182db8-f4e6-4bd4-8951-15c7d5fb77dc", "value": "T18C633F607287DA1FFD274CB00F86A5E53138BEC53D0DBD36604AB39D28FE191AA4DA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507669, "uuid": "57581a06-0f56-4832-bc6d-80d4ff62b92b", "value": "1536:k+a9f4+pee1511depsV01aijIOBqJ4J4:MesVka4o46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507669, "uuid": "35ed5930-41f8-4e08-90d6-fd3f571fe633", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507669, "uuid": "c84e2835-19b5-41fd-84ab-ca1a7af2d667", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507669, "uuid": "1eb6cf6a-d340-4177-8789-bf0723abbe00", "value": "infosecmessage.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b193ac-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511803, "uuid": "df054895-727d-4b8b-a020-64317c6e568e", "comment": "Malware payload", "value": "a6dbdd1896887cc2954e5c2b12c454f9", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511803, "uuid": "f3bfdb7c-685b-4d08-bef6-61b196a154b5", "comment": "Malware payload", "value": "2b2ffb9a2fbf1673da80d3fee086132999593b681c2dda9c666722d627551c33", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511803, "uuid": "54bedba6-a18c-4eca-8804-7e2a6a052314", "comment": "Malware payload", "value": "db3427f5de5c3aaed7cc5d0bf3ad3174070464cf", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511803, "uuid": "b9d41e6d-ba5d-49cb-8332-4f587d59031c", "comment": "Malware payload", "value": "cebc68e07770776c874be69319d0a71b44b81f842cd5869e7dd88fd55c85d8e5de79d26b68f06196c1474cd3c3b91980", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511803, "uuid": "530de3ee-44c8-4ce5-8b54-f6272b93ee9b", "value": "T1D621AD55E591A6E16332A95346F34B1F329B9867A37F1822482E900C0427FBB07B7C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511803, "uuid": "4a3c7d03-af5b-4dac-bd4c-ad886804d7f0", "value": "24:nuAOuAVinOGyinOGyizkgk1kTpkLLU2ZrdLU9nOGyiUiKPhcm5mLHmLokUUiKPho:ntOtVinOGyinOGyizkgkGTpkLLU2NdLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511803, "uuid": "65c7121b-571c-4456-b827-094f305107c8", "value": 1357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511803, "uuid": "2a75e69a-43f5-41e5-b295-f502e437f187", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511803, "uuid": "5f15f1ca-1785-4a07-807a-21b4b42e4e83", "value": "def.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8c123f-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495037, "uuid": "4d57361f-3924-43ea-b0fd-270557a2a989", "comment": "Malware payload (Mirai)", "value": "6f8ee8f10f2fa0aadf6ee2ecce4ec36a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495037, "uuid": "e9cd5351-a8ed-4145-8992-27d5e65c0385", "comment": "Malware payload (Mirai)", "value": "2ce5f6147e12fade80dd75c15e1ef979845c5d66056b0c02e34465b7f9dbada7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495037, "uuid": "790ded1d-bebe-442f-ba90-f64382c88a6a", "comment": "Malware payload (Mirai)", "value": "e93e8cd407a37c6e9d86e549d4cf9612c21d6e17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495037, "uuid": "84eeed0b-4203-475e-8256-6b44c810ae46", "comment": "Malware payload (Mirai)", "value": "63a8974de561bcd6646e3743ab455a8a036c5362b4f5e7019c496a35b60cb3cce1a695a6c527b2eeeb9bbb7cd83dac0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495037, "uuid": "089db60a-1535-416a-a373-efa42a4529af", "value": "T19D230271890B9EB125303C33DB9997937AE025B1C6673013DA290A3C6FB5B131E4BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495037, "uuid": "85a6065c-0d4e-4ae4-a587-ac4ad444cc20", "value": "768:5/TYCoIxdEk+AxoTZAZHFeq8b359q3UELbUXfi6nVMQHI4vcGpvu:5ECFd+A6YHAxsLRQZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495037, "uuid": "b2fdf6b2-0281-4a9a-9814-46ce3df9220b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495037, "uuid": "c2a64e07-653e-4039-8541-292e2f98afda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495037, "uuid": "4eed65bf-03aa-446a-81ad-4f0bf6e5f2c0", "value": "6f8ee8f10f2fa0aadf6ee2ecce4ec36a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29e2d3d-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542666, "uuid": "022577b4-f50c-4693-81c0-0fdada109ddb", "comment": "Malware payload (Mirai)", "value": "9e33ffb99e18bc289b08e62326948503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542666, "uuid": "67aeddf6-515b-4402-a1c9-228429150cab", "comment": "Malware payload (Mirai)", "value": "2cfa0c9ca73876e93165cfc9c46a514aa92cc1db6454a7efa938d309b08d211f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542666, "uuid": "a54f308b-ef75-4dba-a0d9-1bf040bd5d80", "comment": "Malware payload (Mirai)", "value": "ec683bdc1442aa4b5104f6fc39a5a391b53fbf4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542666, "uuid": "17bf6239-114d-4468-a04a-8a90f2324223", "comment": "Malware payload (Mirai)", "value": "46357a4671105bbf1348c3c262962944c8cc7195afe020f7da1869cbb25a5b7f5545398f1d6223897a6c864bace44c98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542666, "uuid": "4aec1a5d-f15d-417c-a908-ada4ccaf05c3", "value": "T1DCA2E17BF9D6088BDCBBE53AB06D45CA0879A81513974BA037533073096B434BC28E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542666, "uuid": "175304ca-44b5-43b7-87d2-8d648dffa66c", "value": "384:MLcDqRfKUWFH39z+/49ETYMV3uBr2goFS3KROig1od4SftODjC1rzvLDG+v1Rpf:mMkKJFH39CBYq34rVorON1hSfADjC1rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542666, "uuid": "996403d6-e378-46d9-83ad-70658c3343d3", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542666, "uuid": "a39c19c9-b012-478f-8edc-c81c8804e87f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542666, "uuid": "6ff8625e-e0b6-4314-b7b8-01cfe98c04f8", "value": "9e33ffb99e18bc289b08e62326948503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f01390e-1304-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659514554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514554, "uuid": "efe6ca11-2667-48f7-8763-1743968b9459", "comment": "Malware payload (ArkeiStealer)", "value": "db5723c9308cb986eae4262297a51fa0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514554, "uuid": "96af41c8-f57b-4108-9a1c-b333e1f31baf", "comment": "Malware payload (ArkeiStealer)", "value": "2d2bdc891614f50e1574787d7728654c02c70eb829a04bd6411ef874f92aa1eb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514554, "uuid": "e3510b31-6940-4c1d-bd25-9eb9a3c1f4ab", "comment": "Malware payload (ArkeiStealer)", "value": "ee4130dcb4052dddcd66a5833b18661187a28f76", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514554, "uuid": "231c7d0d-42d8-4e98-bc45-ed7cff5f4306", "comment": "Malware payload (ArkeiStealer)", "value": "92ea9a70aa061540ee6d153df477a2f1680aae80fc3a4fa0b7a607d8c4f3482378a654589fe5f1f82453721b64a62011", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514554, "uuid": "df56c51c-6da1-4f22-8c8a-7364e954c275", "value": "T1AA749D00B7A0D03DE5B311F4BA7A83A8B92D3DA1672544CF22D62AEE57346E0ED75317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514554, "uuid": "4ba6be26-154f-4f84-8abe-8a9a33227152", "value": "7e4b40ca154bd059f7d22ed12b0ce64d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514554, "uuid": "a1d71f1c-c68b-45b8-a058-958542d5eead", "value": "6144:ewzhZWcL1leWA6JDYyHVV7Vc7JW5VtSZJYnAGiL:dhB1oWjJD7HVV76Y57AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514554, "uuid": "e680861a-b02f-463a-9481-15c252774e20", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514554, "uuid": "08d0b6ad-ae5b-434f-ae76-2ce59aae2f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514554, "uuid": "76e7109c-e197-4e12-b005-da6f3bd0ff37", "value": "db5723c9308cb986eae4262297a51fa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd68e3f4-137a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659565367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565367, "uuid": "507292d2-63e9-417d-b206-ca19124aaa94", "comment": "Malware payload (Loki)", "value": "6e67fbae5f43f0f2ad184c0d6d5e7203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565367, "uuid": "8b8bf9c8-bab1-4277-bedc-ed55f4f0d385", "comment": "Malware payload (Loki)", "value": "2dadd2565077df554abb5c3f02cac534f8eef69a236e5ab135e83bbfd85e1b73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565367, "uuid": "b3255304-4f6f-4779-bbac-4a5690d2f363", "comment": "Malware payload (Loki)", "value": "9d47952deb850d8f91251793dee88bc7ace2840f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565367, "uuid": "30aa5a92-83d8-43d2-a037-ece1bee6aba7", "comment": "Malware payload (Loki)", "value": "d0b88bb369e5875650123dd90ed1997565973179a5f0777b9b40244db75dc2058a1a656b8d69ff5d26afb3c53329f95a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565367, "uuid": "64638ae6-fd71-4894-9bae-4eb90fce2ae3", "value": "T178B4F090226B4B0BE6768FF6F50190401BF5982F2561E3988EC5BCEFD176F924B50E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565367, "uuid": "3d541b8f-9328-4770-8c5e-f65b7b5b1443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565367, "uuid": "4f7e661e-491c-4158-b484-3e1ccf9444a7", "value": "12288:idIg6SKlpxf4WSoQJub0HrgaGdpC6kgoPMbjxjZG4j:hLlpxfZxboHX6DZZG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565367, "uuid": "11d3b82a-2194-4573-b8dd-229d796f8522", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565367, "uuid": "58fede11-b02b-454a-ae24-2de505ab4522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565367, "uuid": "1f16fe1b-3127-48fe-826e-9a215341af96", "value": "6e67fbae5f43f0f2ad184c0d6d5e7203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b01970-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659507588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507588, "uuid": "ae6ed499-c53b-41d0-8205-4af7f2979c99", "comment": "Malware payload (CobaltStrike)", "value": "157da66c314c79c5321cc2e909cfa436", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507588, "uuid": "e6a49ca3-c366-4206-b6fb-3b4c110f2d74", "comment": "Malware payload (CobaltStrike)", "value": "2ed819ecadd3d4a7ab9bd5c88423d0ff34a7df65a651693ec306c6509f34914b", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507588, "uuid": "4c722005-db33-4c03-918e-c25a14ef553c", "comment": "Malware payload (CobaltStrike)", "value": "5d8ed906fd3aaaa9b53c153c2976b6bb4c4cb4a3", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507588, "uuid": "70e95356-ab97-427b-af70-65c825729f5e", "comment": "Malware payload (CobaltStrike)", "value": "09a30948241439c38e7df7b2bab18cd71511d90742f395fea48a2ae823588abf45e06a0898bebba5b55202a477df81f6", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507588, "uuid": "0532b829-a201-4085-8a35-2fa17c102c6c", "value": "T127D59DC7B99195B8C06EC2308965E2927A30BC981F3223D7BA15FBBD2F367D45A34354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507588, "uuid": "6ddeedff-d8de-4daa-891f-f5003735eb55", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507588, "uuid": "2519b6ed-1949-46a6-91e9-0f62589e0c6a", "value": "49152:FeP3Mrb/TnvO90dL3BmAFd4A64nsfJsNtkGrpTHF5gZDBdv8guhecTer1r:43Stecw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507588, "uuid": "6540200d-fe85-4f50-aab2-2bf08cf093f2", "value": 2819248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507588, "uuid": "c88f6ff7-29f2-4dc1-b9c1-63ef956bbda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507588, "uuid": "99ce9ac6-99ce-46cd-bc14-e9274e55d9fe", "value": "OneNote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e1e5ae-131b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659524283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524283, "uuid": "134185bb-5f35-4714-affa-368353606813", "comment": "Malware payload (Formbook)", "value": "248444a96da9f77f3048323e0201bb55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524283, "uuid": "e658c003-7aef-4521-af03-46d31793e280", "comment": "Malware payload (Formbook)", "value": "2fda20bd8202194c2901035a1e57b50d778e809d8e099163a62a37cdef83b1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524283, "uuid": "7f939f43-9953-4681-a468-2d1385dd6205", "comment": "Malware payload (Formbook)", "value": "f25e80904d514a06cbecfa8177926f8ee9a9d6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524283, "uuid": "11fe264d-b900-4102-a745-308ce0a5ab8d", "comment": "Malware payload (Formbook)", "value": "c5a961d43db74e456b27f269eb88a846256973af7a5159b9ef6d5d0be6957f84c333c29b96ab9cd4c01c8d5e9c264aea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524283, "uuid": "409724ec-a71b-420e-8120-7ade1cf552eb", "value": "T17905E01177A48B13E5BB4FF1A9A440540FB3BA297122E38C5DC578EBAD723434A5BB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524283, "uuid": "03c61b05-7f6e-44a1-a855-4a9e824c1466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524283, "uuid": "9f2b46a0-3013-4940-b45d-0345fb9dfedf", "value": "12288:T3F9+HNZg6SKlpxEjin7HSxJigxeac1R+HrdaMAABGEvMeSd56SZUwZ:je9Llpxki7oMXaLc2nvpSOSCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659524283, "uuid": "ad33dbef-8ee8-4ef8-ba77-2689ea5f3f3a", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659524283, "uuid": "a362f7dd-e51c-4dc3-9a32-ddaaec62b20d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524283, "uuid": "c5bfe2d6-0adb-4400-8f92-305bf4ffdd9b", "value": "yeni sipari\u015f pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b179f14-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507595, "uuid": "08a72356-d4d7-4769-ad53-07d67984d66b", "comment": "Malware payload", "value": "34fcdc06ca43251810ea456d364e386b", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507595, "uuid": "ec1e680e-88f1-4b7c-92b7-b7c02e7708d4", "comment": "Malware payload", "value": "30979d6192d60158768f4bf3955399bf3289592403b4899fe7fe5de57d6e664a", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507595, "uuid": "4d1d6969-326f-4fb4-8a66-1cbd932bb9dc", "comment": "Malware payload", "value": "6b20007f61a51fb719d27dc9c5d99e8a8a8066f2", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507595, "uuid": "53668b20-97f9-4dc3-a5e3-8b014e6418f2", "comment": "Malware payload", "value": "babe12880ee647d5c3619f18c75db8b4dc06aa0ad2e1fe63447aec350c0aec87f3d0836969ab5824568d585a8b492587", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507595, "uuid": "a1bfced0-6844-4529-872a-bf0ebb73d578", "value": "T1AC15191BF76344EDC67AC17086679372BA70F82546316A3E2F55CB312F21E605A2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507595, "uuid": "f9f8bcbd-fa5a-403e-a5dd-4470204d6815", "value": "c3af21bbc005d7817532ba12b695386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507595, "uuid": "94219647-45df-4a92-817d-7c9d8cab7874", "value": "12288:rovsVlhFS1WtJP0q6YSZ7V9fVmKSH1iSka:EEVlhF8WzPvSZB9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507595, "uuid": "aa62da2a-add3-496d-985e-56212e8ff5a7", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507595, "uuid": "121cf504-6f82-48d9-b646-9bdf23f169a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507595, "uuid": "b2272e67-5898-40b2-8380-c8f41d7de1a6", "value": "quietmoth (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab4b4cc-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1659539565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539565, "uuid": "4febba0a-97be-423e-8ab8-30ace0eb6d9d", "comment": "Malware payload (Vjw0rm)", "value": "a80fdb6b5e5652016aee90456841d82a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539565, "uuid": "900efdf8-c18c-4fba-b5b3-7e6e8fe8bb4f", "comment": "Malware payload (Vjw0rm)", "value": "30ef8fb7cfd0580323b60ab1639382952877a29bf7d76f492760b47b89a1966b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539565, "uuid": "f07d251c-abb3-4021-a948-059edef9411c", "comment": "Malware payload (Vjw0rm)", "value": "a9a8b2d308d3f8b45a6810b77442943f02cdd961", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539565, "uuid": "44caaaca-789a-4808-a307-8e6a12f8be99", "comment": "Malware payload (Vjw0rm)", "value": "48810348a4de5cc8ddb5b4894975d62ce71fc4e2df565a1a7141dcc85b3180ec8aacbc0073e03987464bce052d9e02b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539565, "uuid": "1e16fe31-1e69-4c92-a30b-a614d424d0a0", "value": "T1B2524BC95C7ABA8CCF1122D125ACAD747BAC6B0F5240465E383D5244D772580EBECA3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539565, "uuid": "f0182602-0fc4-4a46-ba00-78fc586127db", "value": "192:OnRCfgl1g0L+puItXUgM5fpklmzqBR7FgeGu9yQnc6ztXbFokqJpSviB5Hbp9c6P:Omv9XpOJpSviBZpW6JQoONHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539565, "uuid": "ffddcfdb-e4e7-4015-a238-77070c056cdb", "value": 13881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539565, "uuid": "a9143129-6d7f-4038-8141-e39f18ea29de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539565, "uuid": "17c9b3d4-661f-47e2-b458-e61b7e0f9f6e", "value": "jmmkudbbcU_ned7070vjw0m.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712084c5-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507659, "uuid": "6efb095d-cc07-4926-a2b8-4f29914e1069", "comment": "Malware payload", "value": "bb2e1f0a2f1bcb080b06c54273981db6", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507659, "uuid": "aab39e50-9385-4d57-8fc2-68e927737ede", "comment": "Malware payload", "value": "316983eac474a76be3430196b82aeecc1e8168615d2f8137c5d748677cb42daf", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507659, "uuid": "3ed7a9fd-c3fa-4fc3-bbcf-5d89f6d1c98e", "comment": "Malware payload", "value": "a1c9e7f3d06b21507f766be5b8fd42f9527a4b77", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507659, "uuid": "7f827883-2dda-426b-93bf-f110e3432c4d", "comment": "Malware payload", "value": "ec3e4ff4e5b72df66b94b6df6fea703b0cba777c65a9ef435a7445eb50d8bd8286992c2e1d433aa9b40c051b3d25a1c5", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507659, "uuid": "0a3f8433-560c-41fa-aae6-d692c4004462", "value": "T15AE25002B3A9DD1BF15246700DD7F3D6B679BC599E0E830B32487B1EBC792709A16B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507659, "uuid": "acd43564-7038-43ea-9d46-8a2810ea0f70", "value": "384:I78iSsqdg1vA9c7fiFgqBsiZ0jwyAe3V8RLZetd+b:IQ+1o9aqOWByAe3V8RLZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507659, "uuid": "6c95c099-80b6-40f7-aac4-16833edc8ca7", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507659, "uuid": "133b9503-85a0-4ab3-80f8-ca661484a6e1", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507659, "uuid": "a78555c1-82e0-45b3-a89c-d345402de7bb", "value": "Doc1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10011557-12cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659491605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491605, "uuid": "a542c38f-f7cb-4241-ba7a-4f576503b207", "comment": "Malware payload (Formbook)", "value": "34e704a98cfc12b81fa55b471d015729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491605, "uuid": "77dad827-8575-4025-ace9-ecf717f3d146", "comment": "Malware payload (Formbook)", "value": "31ba919a8640e87dc1a63fd6029e3920c01ea87bba6a2d3dca8074097525e0fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491605, "uuid": "fd283fe9-a4e5-486c-9537-98da8807c54e", "comment": "Malware payload (Formbook)", "value": "b58581a87b55433a153258472bf9cc9ab82045d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491605, "uuid": "f150bb95-2d3a-4210-9be4-68cf5c26711f", "comment": "Malware payload (Formbook)", "value": "3f1c62a2b31f416599e2b2364c16be39f940f1e9285584c16ceb7806ea912e7c68dc4a614a9168d0b4e48fc42772f4fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491605, "uuid": "ebf23f69-7bfd-44f6-b9ec-2c3389354b1f", "value": "T1CDB318897650398FCCA7FEF169F05C15AA207CA21316C287E4B7B5588B3D387DD841AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491605, "uuid": "5a13fd14-c62a-40a3-a7f8-74a57c3d1d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491605, "uuid": "74231d8f-e134-490d-b535-5881877c5777", "value": "768:o/FtTxjScIDVuu/3Vc4oEi1vV8B01L5hg5SyHEXrlIS1UBuzexlmMwCK/3deVDOi:AFfjSlsu/y47i5VJyHS9cl630VDOpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659491605, "uuid": "0e2ad15f-b609-4449-8067-bf33681e548a", "value": 116288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659491605, "uuid": "23094615-2f66-4402-b69e-f71722620a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491605, "uuid": "c253798f-8015-424b-aae9-7531f1b57924", "value": "SecuriteInfo.com.Trojan0056a1fe1.9302.10005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfc5d90-12d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659494069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494069, "uuid": "12fa6a7f-cf8e-4ca6-8b32-2b78883df48b", "comment": "Malware payload (Mirai)", "value": "1868d26ab8f6922b53a1d07320e58b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494069, "uuid": "5a9bd731-ee3b-4aec-b19f-7fded8f33a9c", "comment": "Malware payload (Mirai)", "value": "343aedfb228b0ce60d99af9831c22e43804becdeb4f376f28c3f74853993187f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494069, "uuid": "d5494546-87cd-4b0b-9ac5-d5b181615afd", "comment": "Malware payload (Mirai)", "value": "af05f1e8ccbfa588dca6fba28738209c70843607", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494069, "uuid": "4a29fed7-9dcf-43ac-b04c-88dedee82c37", "comment": "Malware payload (Mirai)", "value": "4879123f9158465e07619003f8920ffe16ae394cab80849dbb2e49ae8e5c331285aa28881a9ebe47838a2b847683a921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494069, "uuid": "8227bd1e-51ee-4ae8-a353-3833422de12f", "value": "T104C2D1E07726E931C420AC3DE52B4C893A51163CD1FF383764259D359FC169A63F88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494069, "uuid": "10a8447a-fd0a-4499-b228-6c31748b4c44", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwro9q3UELuE:PKy4qfqoeJdXWgRL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659494069, "uuid": "f6ceef79-e942-4ca0-9e02-9685a65b73fd", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659494069, "uuid": "7f4d0b64-4fac-4640-b226-a82a6be239ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494069, "uuid": "8d79d386-a748-489a-9605-dee1b530a446", "value": "1868d26ab8f6922b53a1d07320e58b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0851a9eb-1344-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659541843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541843, "uuid": "b4d90667-f31c-4d3d-baa7-8bd2025c4262", "comment": "Malware payload (RedLineStealer)", "value": "394a0b180c9eb9df9625fbce00aa096b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541843, "uuid": "f7398f9a-6800-4f19-93da-660859a1b16d", "comment": "Malware payload (RedLineStealer)", "value": "34c1c1d65c4d48e804c8e1a2f2d4b29ace8b48edc8d67a794d8ee4e00d64e0c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541843, "uuid": "799db5aa-10f6-4b64-bdd7-67b10c51608a", "comment": "Malware payload (RedLineStealer)", "value": "8ccc1938e4fdc4e95e9679689573ff00e9a31435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541843, "uuid": "c5bde3af-beec-4e98-b3d9-b1ae6869b1c5", "comment": "Malware payload (RedLineStealer)", "value": "7427c1eadfb84baac20b38e2d45c09ba3163f4d4c9a7211a9dee06401672cf3cfb5b07eea55c3b6a30a9f6b93ea470b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541843, "uuid": "af9aa92a-8a40-40a9-9d68-511fbe72a0e4", "value": "T1B3E5DF5124CCC3D3D45DF938EC84B3180213EDDA6B8BEE4E6C2DA5E2E97610754B68AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541843, "uuid": "36d7534e-dea2-4fc6-85bb-b48d4751b417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541843, "uuid": "41d0efda-51f5-4262-a075-2358a00c7494", "value": "98304:1TYCz5GIppW6jk6sQ7B5cxOb8B7TRRFfVtO:lR53ye7LsuEXRXttO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659541843, "uuid": "7d3d39bd-e3ed-400a-902e-3a0838dbdc7b", "value": 3220898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659541843, "uuid": "fc8acb62-0d29-4181-b951-19373d9ad372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541843, "uuid": "008b02de-dc4c-49df-a744-f3e7d31b3413", "value": "394a0b180c9eb9df9625fbce00aa096b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2808c6b0-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659507537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507537, "uuid": "c67ed90d-72c7-46c3-94e7-934bb34b47db", "comment": "Malware payload (CobaltStrike)", "value": "94b985295af69e2bd6d26eb5273538f0", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507537, "uuid": "458c7ef4-0b1d-4577-9ee4-38c6ac0ef18f", "comment": "Malware payload (CobaltStrike)", "value": "356bef23d9b91f713fd54e5bef83bf738e869ca51324b580aed0d649bfdefea3", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507537, "uuid": "c0409e78-a9bb-407f-afe9-00a9e25eff67", "comment": "Malware payload (CobaltStrike)", "value": "b132238e1119ddfbebbdb36d61a126a06962671d", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507537, "uuid": "bbab5edd-9096-4783-8796-207207c1b4cc", "comment": "Malware payload (CobaltStrike)", "value": "7ae4780e5334136ae9a98d2ac2f69569bc3c306da4b10ceb781cefc92a60553f4e2085c3cf06004f4de6ab47081fbc9f", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507537, "uuid": "fe2d92e4-e72b-49ed-89e4-e15248aedf45", "value": "T1A5745A473F5969EEE212F527E63DB0C225E0752E90A98AD4B7F1D4B118F802234F47A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507537, "uuid": "88174174-9c44-4b4a-829f-63a76057244c", "value": "6144:pbCjcsg8y7zWnBDNyGzj++6USqvoPrEBrtWeenmN0ZqnbdC1Kd2kdXsGlmJ9lFSr:pbC4sXyvWdT++eqvoQBrddokdX/G4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507537, "uuid": "6a8a9843-c6f4-40e4-841e-d47828099b6e", "value": 352571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507537, "uuid": "c21f8019-90d2-421f-8d1f-5703ed03616e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507537, "uuid": "1e0e9715-7f50-4d7e-85df-8e22e5356484", "value": "beacon.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaff93f-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659534390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534390, "uuid": "8ca5896d-3021-4928-8978-fb6f901915c5", "comment": "Malware payload", "value": "d5f811a8f1ba3b1cbdfacdb8d003e1fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534390, "uuid": "418bc9f7-9ba9-40a8-8ea8-1bdb486239f2", "comment": "Malware payload", "value": "3570d7dd52d4ac09f3c206d718b8d66280e83c18d3292fdfb729f6e8d8999ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534390, "uuid": "7ddad546-c15f-41f8-92cc-112f6aacbb7e", "comment": "Malware payload", "value": "8f4e67cc8f402d06ed58b760f45154aed5e72ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534390, "uuid": "4bda517d-6c59-4b39-a688-e60445ea1d96", "comment": "Malware payload", "value": "f7d0f01c3d741d8488c5cb2dcda14fb8ba791d2722d810770f2ab8a89fc126b82f7969dca08c9e9e40558794eb851706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534390, "uuid": "2eddc052-36c7-445c-aa78-fda1d49968b7", "value": "T179A47C96F2B540B9D0AFC6B5CA12961BEBF1784A1234E74B42E4CBF61F13B71661E310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534390, "uuid": "7598e768-2d1d-4840-be79-8da4319fc532", "value": "12288:S5WvIcqgICTR6RB2JiIoHxXmwN9LR3vd:aWwcRICTkBIoR2wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534390, "uuid": "ccff0b1f-1c2e-4525-af1c-0ffe6a11dd25", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534390, "uuid": "cb86ddf4-930d-4136-8993-16474770a2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534390, "uuid": "f4c2caf6-4542-4e51-9697-bc6d8690a528", "value": "12910000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5917b9d-134a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659544684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544684, "uuid": "12383df0-ab9f-45d1-aa2e-59164dfa6e5f", "comment": "Malware payload", "value": "1846b90b5b25bb9de27ed201bd3664e8", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544684, "uuid": "6b9addd7-34d7-4734-b95b-f705c60acb24", "comment": "Malware payload", "value": "35be59d12969db50a11bc73de2e652b225e333fd4657166568a102dcf4211751", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544684, "uuid": "7b1c533a-3ca6-494c-a3db-ccb7ac382951", "comment": "Malware payload", "value": "e203c2fc072f1ca5c65b7160c8f5b97fdb48840a", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544684, "uuid": "43b62839-69cb-4743-9c6c-f3822d6f2723", "comment": "Malware payload", "value": "58533b865bc4fc5fb066d81c196c1b4baee4a18b4b7cf4057ca42a91fe96f1685da124ee217a877406a9b705968adfb7", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544684, "uuid": "359226dd-dff7-4c01-9ede-c07f1ffe4a76", "value": "T1E351966135E2B95992535C712FC72201382481A76518CB1E3CDDADD2EFD091D87E33EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544684, "uuid": "1a146dde-d0c2-4ca6-a805-6f61cbae09ee", "value": "48:Tm39phipuMfsUKJDmyf6DzJG7LJMyaWvbwAlw1JDJYPJKzOJOO6bb:y4fvKZmyfioaPubH6Bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659544684, "uuid": "b7e3ce73-2d8d-427c-a47f-8181582015b0", "value": 3137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659544684, "uuid": "c20f89c8-ae3c-4fb5-98c0-8cab581b22db", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544684, "uuid": "34f36d4e-971f-4d05-9d56-04c60f34729f", "value": "iLsqd81V.decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458d0770-1343-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659541516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541516, "uuid": "9bb62128-c664-44ae-8c49-a49b8a9f7313", "comment": "Malware payload (RedLineStealer)", "value": "5444bb6ecd7a6a7cf116727b040dce76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541516, "uuid": "228a88ce-b0d5-4c60-8d1f-0748a71b173d", "comment": "Malware payload (RedLineStealer)", "value": "35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541516, "uuid": "ab2a7b0a-5a1e-4313-b13f-1293da0781ec", "comment": "Malware payload (RedLineStealer)", "value": "a6b4491e2725856660d813d6d584dab208ac4107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541516, "uuid": "186a0530-2c9d-409a-bc8c-8016e3e06bc8", "comment": "Malware payload (RedLineStealer)", "value": "903debaf1e34190305ac0dd9ffc96452837cca650782dee2ec833f5b1893c5787d3ebbaaf2e87e4565adc8d2aa4d4880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541516, "uuid": "ee555e77-7f83-402d-80fb-0e4f63d20f0b", "value": "T1FC54E12DF7E1C432E9A35838487497A16A7FFD222AB445CB73641B2D4F717C06A3871A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541516, "uuid": "9e6703ef-eee2-47aa-9a59-f9a01e999531", "value": "66024f9fc825520e1141e944711cd31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541516, "uuid": "25588a50-9999-4057-a1f0-e6c8546aee47", "value": "6144:o6++xCSIEQ6PFZF4Bo6MBioHBgSAmm3d90n+fKjv/v76j:oQlQAFZFyo6MB7DmEnSKjHv7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659541516, "uuid": "6a2a094e-a8cf-4698-bd95-c0e1d507cf7f", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659541516, "uuid": "f18011ea-30bb-4b34-b0b1-9112f9cd1694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541516, "uuid": "67532246-632c-4510-b08d-97db272e6ff6", "value": "5444bb6ecd7a6a7cf116727b040dce76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a96f09f-1333-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659534626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534626, "uuid": "20cd4a5d-5d6a-4b7c-aae8-fd60c9758603", "comment": "Malware payload (Stop)", "value": "f321345d6e70b4b54fcd6967fb2fb298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534626, "uuid": "6c83eff8-bcb9-4ab5-be7c-8b2c9623c4cb", "comment": "Malware payload (Stop)", "value": "36bf00125e0982c8037f04ad0dd3a354b5e8c95fe899c3083344730d0f4c2682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534626, "uuid": "e9fe685c-7d58-45eb-b5d5-656f7777f219", "comment": "Malware payload (Stop)", "value": "55fcaf3eb2c28f4d202a933cb3d2cb54dc283868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534626, "uuid": "9d923607-aad2-4a50-b1e2-3b0f37ce27f1", "comment": "Malware payload (Stop)", "value": "335b0b6b867d170940dd73803e35c61a8464d3f6ff727e68e72c9d8ae8db0a15f5fd6b534440ac46f0b3eafd67c739a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534626, "uuid": "16947e28-130a-49d2-af33-49cdb5767d2d", "value": "T16BE41231B7E180B1E5F616B14B7087A2A53BBD633B75AB4B3390026A0F317D17A7531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534626, "uuid": "31c031d2-03ae-47f6-9f0a-0d102e6d9eb4", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534626, "uuid": "ec0e8b1c-f545-4745-928f-73688b2ff53a", "value": "12288:7IPRng8mOJp9qpzac6Sod84kDC+lzO1qZxGzso9pz0P88Q:7Gkmmpzv6SUoPldvPo96PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534626, "uuid": "be77c876-b5ae-4a56-a94c-7006ed0150cf", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534626, "uuid": "1f095493-1399-4bab-b20b-1be1aa0d9db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534626, "uuid": "511602aa-25e6-447b-a924-8b831a0a3e97", "value": "f321345d6e70b4b54fcd6967fb2fb298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434029d8-1307-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659515743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515743, "uuid": "6010fa2d-3f57-4233-becf-469e7f432dee", "comment": "Malware payload", "value": "5de6dc24b27855a3439509b4ea11943e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515743, "uuid": "0130571b-d385-4759-9612-79f72a745c7b", "comment": "Malware payload", "value": "378cf47345173ed9617ef1571179bf1c543cf96f44b1e708531d678728632ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515743, "uuid": "9a3af3c8-1d74-4040-a0e9-e4653e3c0502", "comment": "Malware payload", "value": "388d6236fdcb8db3648bfad425e7172024518a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515743, "uuid": "5ed2a1a9-ad4e-4d1d-826d-d87ccce09692", "comment": "Malware payload", "value": "349f9af129a60cbb00183a059fc56664ecd58602a703b287bfe3bc6199674cde446f82e8a0570837f0a36fb18219a98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515743, "uuid": "7b2d41fc-41e5-4afc-a5f4-57c4b5174b7c", "value": "T1BBF402B3639F8B03C4398F7EE0860ED2476AC17F5652E305E8B83E7F619671A45A0746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515743, "uuid": "ff614ee8-ef33-4e6c-98d8-07da1e2da045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515743, "uuid": "a695f4fb-de89-41fa-b8fe-7da01a323d62", "value": "12288:yiDvfxg6SKlpx3L69yn7cOERg5E6yG28igIgoVlzZi0h7oZwXwLd05A5sh2BR+0t:yu/Llpx3QyAwE7f8igIgo7+aAKhKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515743, "uuid": "68768587-f42e-4097-a043-8f45bc2b8887", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515743, "uuid": "9de2fc80-b277-4fcd-aaf4-5212c8c147f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515743, "uuid": "34335467-333a-4578-86d5-aa0bc6f9d0cf", "value": "SHIPPING DOCUMENTS pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d8a380-12fd-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1659511538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511538, "uuid": "1bf66036-9289-46ba-9fa6-1f57224de274", "comment": "Malware payload (QuasarRAT)", "value": "943b330ab4781dab7b5b9bddab608fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511538, "uuid": "961e1917-f1db-4928-bdc3-a2f615012689", "comment": "Malware payload (QuasarRAT)", "value": "3801e7b74aeae99f2c8a677ecc5543e7f29bcc005290c573dc395cf017c898da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511538, "uuid": "bf6e271c-2756-4e78-a304-ea4dfb290188", "comment": "Malware payload (QuasarRAT)", "value": "e4bae6af51dbdd56f2a4456f8a11115e44f0282b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511538, "uuid": "ab2b6dce-d186-40d6-9b28-bb8da7b733df", "comment": "Malware payload (QuasarRAT)", "value": "e1be1f9e54e93edd58098258d4438307147c925bc0638abe3b0dc4a2be71a50050861f9fdf4e844b4935ecc7094c2905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511538, "uuid": "f5519bf1-65b6-41e4-ac84-27e7b356a01f", "value": "T146C5126221D87269E0364E778BD0A46417F5FD46F309E6266C91338BC3F7DB08D62E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511538, "uuid": "98b02621-bfab-4365-a7d7-40c39c726913", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511538, "uuid": "d0e8474a-a522-452d-8ee0-7f787541376b", "value": "49152:LLuyy+txb7aFHYN3kXsOJAhTmxbgV8BvVH79nNKMP:LJy+tp7aWN0yTmRgWJVH7BNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511538, "uuid": "88bab299-e1f6-456d-91a0-89be2f6bc1c4", "value": 2542592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511538, "uuid": "7fd4cc88-a6b5-457c-afe3-c4d9de9815f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511538, "uuid": "cc451c67-dd8e-454f-b41c-d00bc4bd374c", "value": "RECIEPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f2d2c4-131b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659524445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524445, "uuid": "267086f2-28b3-498a-be58-3a53de987371", "comment": "Malware payload (Stop)", "value": "02ddc6882510ef7f8a8d8dc66ff58428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524445, "uuid": "d5207e8e-fd60-4843-ace7-4dba3358d9e9", "comment": "Malware payload (Stop)", "value": "3887028a0090bfa67d9c9ead0a6e30b0fd41a0ab974e2cdf4fb4fffc0f505f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524445, "uuid": "adaa2cc3-9c6e-4d3d-abd8-b4f95ce53d1f", "comment": "Malware payload (Stop)", "value": "c61e8acff76637b99867238815d1887f5b9b9db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524445, "uuid": "78fda5ce-2c6b-4404-9854-5331cc541be4", "comment": "Malware payload (Stop)", "value": "b884018be6fa4711e3cc742598cc27ba829788062af0d2372082ed344b84dfe9a9e75eea4035cb670f996d2c0955cc96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524445, "uuid": "1837d12a-0e7a-44b6-a58d-c3475683aed8", "value": "T102E41231B5E1D073E8A329301876CB946A76B8620B71B5CB73E4173E5E25BE0BE35706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524445, "uuid": "a9ab028c-3c5d-4259-ab1a-9216e4321f63", "value": "4cfbd807e4155075766f9f516fa9a7f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524445, "uuid": "29e34fb5-2a6a-4f0a-a6ec-9fb2a173ef54", "value": "12288:Mj4/sKoYrH9gWgqoTTBy7PaNsixedh84GzVOM8fjrPMhM:Mj4HrHEkoxed2lzV2rPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659524445, "uuid": "dbe21d06-ccba-4b64-a33b-3fbaf9b73087", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659524445, "uuid": "db7f3011-0355-42a0-bab0-32f5e07bfb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524445, "uuid": "ccde4f29-6601-45b0-9cff-f0be44752b30", "value": "02ddc6882510ef7f8a8d8dc66ff58428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b5ce71-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659513942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513942, "uuid": "6802adee-6cf7-4323-abd1-13568eb7c479", "comment": "Malware payload (Stop)", "value": "3284212c076a833959a98601b6542d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513942, "uuid": "28145a2b-4584-47b7-b2e3-9f4339c8a55a", "comment": "Malware payload (Stop)", "value": "38cbd610f38e27ae9927d723806923926d206f9552f4d5b38891f1c7ea422f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513942, "uuid": "493a728b-84e0-4de8-8d95-bd43a521e81b", "comment": "Malware payload (Stop)", "value": "6bd0f21adba3a11d941578b9e31087fb5aa5257a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513942, "uuid": "5c6e65f7-6054-4068-9141-3a5a542b3d52", "comment": "Malware payload (Stop)", "value": "eea4b1f71f65efb549919e57a9190ca1a840f879cac35562afaa3c187873197b4566aefb09272062955803b36ea57f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513942, "uuid": "8c3f3693-2d70-4248-b4e1-cf469d379895", "value": "T11E15F144BB90D438E1F742F4B67693ACB63E7E915B2114CB12C22BDA66346E0ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513942, "uuid": "4054128e-6e3f-4246-9b5a-7419bee6d417", "value": "8dce72c9fe1db39179f8aff188385a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513942, "uuid": "bfcef540-3394-4ff5-b54d-f3c3f79bc020", "value": "12288:cf5/j8+Tuvpe8KZvKiG1SYDmWh682ESt2eEk9e3aH6Zlc/yboe8kw/EN4RBE2GYE:AHT3lVOMGSceL+aHI+1zuey27F+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513942, "uuid": "082722f2-f5bf-42e5-9f9a-fd62778dd6a3", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513942, "uuid": "f097ca18-4f22-4033-a2ab-1adfc9412547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513942, "uuid": "dc56f1be-e939-4785-91f2-a108d256425a", "value": "3284212c076a833959a98601b6542d84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef0009f-137d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659566523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659566523, "uuid": "2db02c1e-9c54-4f6b-aab5-04a32b525f81", "comment": "Malware payload (Formbook)", "value": "92ff3c4a3f069eb9d2b2ac4a89a51186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659566523, "uuid": "743f3c80-d820-463e-83ad-0c21b74dadad", "comment": "Malware payload (Formbook)", "value": "38d044fdd11426edd1c5e85a2af02b274aa3d26f4e4d21a4b298b394975b9b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659566523, "uuid": "7ba4154a-777e-4604-811b-741b854e25d1", "comment": "Malware payload (Formbook)", "value": "b72523e644abe5a3aeea6ccb5b01a955d55dc207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659566523, "uuid": "2c0c0223-d1d8-4825-9877-bf4597218b6e", "comment": "Malware payload (Formbook)", "value": "1c95740e4d51b7c33c37f5d50598909e02901f6d735cb360db303bbb8c7be00c36348a7d2000478a4d4e026582c73151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659566523, "uuid": "d411ad91-9165-4848-b58a-4107b08acd50", "value": "T147D4E0CB763E329EDC0F57B42871A3E28B5BEA13112497253AC788EEE440B5511867F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659566523, "uuid": "74543140-83b7-43e0-8472-f935b1b21905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659566523, "uuid": "428733f4-84cb-4a03-a110-19b6e8fddbd2", "value": "6144:9kmToIsFRUHbDv1KAIIu0jrAHJvktHf3W0woOt8vk672X20ZFHONEavil8p6Yk7i:OJImqNPYwHfixHR2ilKJ8VJ6Pi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659566523, "uuid": "800a7d89-c72e-4178-89dd-6615df8a3002", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659566523, "uuid": "d6e34ec6-7bed-43b6-87b9-4416125e7466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659566523, "uuid": "097e4f9f-c781-4900-9839-eb8636989e14", "value": "Versanddetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc37920-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1659512650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512650, "uuid": "61fefcd7-6875-4488-b270-93b8fde6394c", "comment": "Malware payload (BluStealer)", "value": "a8643fe2ffa8f2e775c07707f7f3c9b9", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512650, "uuid": "e6204e34-261c-4699-9bc6-16d8b40c6222", "comment": "Malware payload (BluStealer)", "value": "39783276f1af854d10a9ab527fc362c912a51e487e726c97ebfd69419526db8e", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512650, "uuid": "2cadc823-1f63-4249-a1a3-22f5f70665c6", "comment": "Malware payload (BluStealer)", "value": "bf06cb157fa08e4c21e5d59892b5bf7e3958e13b", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512650, "uuid": "1bdf2a9e-80a0-4cf2-b2a8-65170458300f", "comment": "Malware payload (BluStealer)", "value": "016abb93ed6d45e92cc20bc4a7d07134d05b722be224c0d4e7df734f23162139e46a49cca36634103a8cfd94b0ebaad4", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512650, "uuid": "5b2bb75e-ff75-429b-a7dd-cb2a78742016", "value": "T1C503F28359BE26060ED98DDC0F3815DAF46D1194A1AC613A33DCD9637B2325E78617CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512650, "uuid": "673a3d7b-33c2-4b86-ba24-95804686d942", "value": "768:iMPtosjpqtfKDt9DuGEuPh/FU+Biv0L4a/pz144QCuq54Lpy7/UtePGmJ:lktiDHuGj6vta/pzm4JuNg7TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512650, "uuid": "7dc1853c-fcd6-416c-a55d-df7f797928d6", "value": 38621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512650, "uuid": "4f6e772f-e30f-49ec-a0a9-d31d3ae4ebd7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512650, "uuid": "14a63d26-c29d-4fda-9561-4ca099fac3d9", "value": "Micro tunneling Drawings.pdf1.4MB.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f79505-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659511875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511875, "uuid": "648da29f-7e7c-4ac8-955e-c58451a9b41d", "comment": "Malware payload (CobaltStrike)", "value": "bb0edcf312622f518415b85deec29be4", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511875, "uuid": "51e290a4-4e25-4682-bea2-c40f6f85b5ff", "comment": "Malware payload (CobaltStrike)", "value": "3ae4fa96ff3527bf4ea380cbcab19b7e9b0d77c3596d08f74b18b7b843ead231", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511875, "uuid": "af5555ff-370d-44d4-8e33-0a9215933411", "comment": "Malware payload (CobaltStrike)", "value": "72bce426b56988b225862cc6611abb53150bfbc6", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511875, "uuid": "56b4063b-4292-4834-821e-971ce5c6730e", "comment": "Malware payload (CobaltStrike)", "value": "2f7561dade297deaa81b54b8683922295f15705d5228b48932edc09790c5d52b8a0610c24d98918000d2962174a218f1", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511875, "uuid": "f0692409-aee2-4b73-805a-2c617e6701d4", "value": "T1F7B23B3FA753A4F9C64759708AEB16F1BA7339A0167041390F60E5B01F22A60BDDDB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511875, "uuid": "704ceeac-4178-42a7-b56c-ba6c10733116", "value": "45d51bb2a26e8506fa017fe49072c102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511875, "uuid": "c5838cd7-6671-4104-b569-6f16748976c3", "value": "384:phVnJLbKVANB44FcFcn6VVR7sLLocyLJOPYxY6GhX+:BnZK+4Dw65s309a1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511875, "uuid": "d42b920d-1030-4921-bea9-9e3e68bf6230", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511875, "uuid": "cda1437c-cb48-4f72-9779-b9b1f5bbaf7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511875, "uuid": "8d7e89f2-89c5-4bec-9a9a-769b354386b0", "value": "shell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412149f5-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659495123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495123, "uuid": "8a99cfe8-58fa-46dc-a627-bfbb35f02e47", "comment": "Malware payload (AgentTesla)", "value": "5d916fd0ce0a25a7f2fdd72ef8e96d6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495123, "uuid": "7b2b1b2a-5010-44bc-9b06-118503af0ef3", "comment": "Malware payload (AgentTesla)", "value": "3b1a21ac379a07a71181efc7a31ced67b258882b7629053792013ae1bb15e017", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495123, "uuid": "9d8abcf4-0c39-4e9a-8239-615258e279a4", "comment": "Malware payload (AgentTesla)", "value": "cb01afa47335699ae618f6ddaca6cfba9ad333f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495123, "uuid": "9e8bd4f1-1fb8-4979-aea8-46bffaa5da37", "comment": "Malware payload (AgentTesla)", "value": "1fbc212fb7881db3f4bd6ec51421ec61a9811eba91075926dcea5f720335c4bd47297d24b754913ead5d0e8dd9efaebb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495123, "uuid": "329442a1-a51f-435e-914b-42f4b4222d79", "value": "T131E4E42C3A417A72EE5D9170D9030A39BB660B03EF4AF9C277CB25CA877F1695D45C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495123, "uuid": "cc2b972c-622f-42c8-8872-a9cebfe0ea36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495123, "uuid": "79f5bba2-6185-4c57-8dfd-6de51d439032", "value": "12288:BQUNBplBGbey6gE91ug6f76yid9TSq/BWyDht8b4doZ7/n34L8wF8:D3dKUSQbhtOYg7P3s8wF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495123, "uuid": "dc52ab10-c0a4-44f2-b2dc-dc79add70ae9", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495123, "uuid": "38d7e053-eec0-4705-8d74-1a1b5416e7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495123, "uuid": "9c5a4c35-04cd-4b83-a397-4e13563da27e", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9473.13691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1db74c-1324-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659528107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528107, "uuid": "c5e653cc-aa34-4b3d-9845-900c710e18e0", "comment": "Malware payload (Loki)", "value": "f0979db006289fdc43d32331f7f3257f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528107, "uuid": "ef04ae0c-69bd-4e84-be9d-2a1719f603e0", "comment": "Malware payload (Loki)", "value": "3b4a6f479c3fadc4956d9abc9f61fe3979113ae37d1fafe126354358eac5f27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528107, "uuid": "0f72eda8-3fb8-490f-a17a-a1bbae9051d0", "comment": "Malware payload (Loki)", "value": "70fbd2e73c79b921503af9780705fb5ffcd621c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528107, "uuid": "a37a6cf3-2e69-471c-b10e-b50ee613bb20", "comment": "Malware payload (Loki)", "value": "5e644809d893e64f537e943b25f6b342e9b6ea7661cbb78bc5e097907e0cd8d16c6361a66240e7af15f86385d7fe2ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528107, "uuid": "73277d8b-f778-41aa-91b6-7ce7c7e7500c", "value": "T15065CFD098945864FD1E4F3550321C30416FAF7ABDBEF68DA91E709A7AB72C39132A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528107, "uuid": "72ff0cfc-510a-4060-85d8-c9b0feae59b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528107, "uuid": "46783200-d971-4610-baff-9d510ed483f2", "value": "12288:C2PWZTz4OXQpRGqxXO3Ld5E3WXLrF02nxzmU8VnOjRWKwsXdykxWLjo83XwhbCNs:uXzXQpRGF43qFH83RcdykxWw+/4t+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659528107, "uuid": "f113de9c-4e23-44ee-a6f1-a896abf4569b", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659528107, "uuid": "415f7c91-3f2f-48c4-99f5-2072831b0d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528107, "uuid": "538a8a21-0e41-4499-b2cc-6f60e21e014d", "value": "PO-MDR-120-2122 - Medior UB-L-Asparaginase.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f9166e-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537918, "uuid": "4dfc55b0-795e-44ce-8131-51d2784d924d", "comment": "Malware payload (SnakeKeylogger)", "value": "5ecfa951459f2920fbcf87d261d2c172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537918, "uuid": "0a474b09-ff98-4cdf-87f6-8fd7ee3ec5a3", "comment": "Malware payload (SnakeKeylogger)", "value": "3b7bd3400b14a3c32cc1caae51dd966103dd88f49cb09c8e33a80a031b0f15ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537918, "uuid": "7f2e4ca3-ccec-4e6e-bb8c-7320f3d29594", "comment": "Malware payload (SnakeKeylogger)", "value": "ecbbbba0359fab354c17f92e0468953ba85dd305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537918, "uuid": "f606e01c-7619-4bc2-a036-e2764f8a916f", "comment": "Malware payload (SnakeKeylogger)", "value": "755ab6fcc1f9207e156b825c70ec8c419ca09b34c62e331a58d581baf1130b45736ef500fa1c195a0a399bcc3ec1689e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537918, "uuid": "3808b6dc-f48b-4a63-b912-ae6824b09756", "value": "T18FF4DF5023B48707E4BA4FF5B5A400141BB7B66A7063E35D1DC938EB6EB23434A1BB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537918, "uuid": "c9242992-3cbb-40b1-8d7d-c26f59ab1dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537918, "uuid": "bfe0fde5-0014-4864-ab7b-e3216d20bc48", "value": "12288:a3F9+HYg6SKlpxpvDUMcUetKiW5qrpYtkR6wky8hlUP6FMnOzvU4E/:6e6Llpx/zeAiW5PDpOmU4E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537918, "uuid": "c412bf64-de1b-4c1b-bb23-c8d8fba38ea5", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537918, "uuid": "185fb551-df9c-49f0-806c-bc0b195808bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537918, "uuid": "009b728b-2247-4350-a5e5-77b9b72d6cc4", "value": "IMG_4309500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d5a62d-1357-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659550045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659550045, "uuid": "fc3d2ba3-5122-4472-9873-9cae6eb6f1d6", "comment": "Malware payload (AsyncRAT)", "value": "dcf4f7da3a6ea1710aed451b8528130b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659550045, "uuid": "cfde99c3-3474-4042-91ba-fab76d922429", "comment": "Malware payload (AsyncRAT)", "value": "3bac77ba1ac617027c4185c868ee698279e559a444b878207b7349d0fe9927ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659550045, "uuid": "8f3e0679-3c3c-42d3-aaaf-ab873f11afc1", "comment": "Malware payload (AsyncRAT)", "value": "bf22f23c1a10bf6a5486c5c37224a69b49a27e68", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659550045, "uuid": "3c66f787-ae7f-4826-a7b8-2d106ec81c62", "comment": "Malware payload (AsyncRAT)", "value": "aa55e81c13cd562a75aa100492ca5800ab21d49501a7701286be0ff29cb97df84938719be11fb351e322146a1c2c0ac1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659550045, "uuid": "da91e1ae-050f-4537-8c72-0d1494ce2cee", "value": "T1FAB33B00EF9B821BE17E5B7468F211517236B316F2D3D7492CC462B6DA53F827902DE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659550045, "uuid": "4eeb8890-309f-4401-9fcb-dc2916e25a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659550045, "uuid": "c4987486-fe22-4f5f-9e86-0be6f57c2190", "value": "1536:Wu439TswI23S/VGvMCMBG2bnyxwiDd//Q3x:Wu4NTswI23xUCMBG2bnExDq3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659550045, "uuid": "730d13dc-3222-4e41-931d-4b9042445eed", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659550045, "uuid": "358697a6-da66-4a34-91c6-05506544ecb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659550045, "uuid": "58fac2cd-267f-4637-b3c8-c01e8c71a039", "value": "bDUH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c44e6bc-135b-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659551755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551755, "uuid": "4bb2079c-b7dd-4e9f-adca-5a17df62fa00", "comment": "Malware payload (RedLineStealer)", "value": "ed82a226b08071bfb5aa205173661af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551755, "uuid": "ef6ae95b-27b3-4ca2-8e5b-5374355028f8", "comment": "Malware payload (RedLineStealer)", "value": "3c79c2b0938109da24b4e5f41195efc9245cc9fe41a2de463a64126f8c11b550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551755, "uuid": "881dc7c0-eabf-4618-857c-1a813f524655", "comment": "Malware payload (RedLineStealer)", "value": "69f389f837b842eccb5efdeddce4c2b92432a5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551755, "uuid": "023459e2-35e0-4707-a22b-94cd15cb3e96", "comment": "Malware payload (RedLineStealer)", "value": "108ab73ec7c4f49ae704a3c699f0402fa77d7bfe41a61afc0a5f209b78ee0fa5349749748e9139621de2aadd2c14fbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551755, "uuid": "6c2bf4b5-1dba-44b8-9bd1-dd56207ca57b", "value": "T1AA54E02137B0C471E5B71B3098B197A2273FB86366F495CB33621B2E5E617C16A38B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551755, "uuid": "51582ab6-367a-4b06-935b-65dadc20f685", "value": "66024f9fc825520e1141e944711cd31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551755, "uuid": "8527d808-8532-4b2e-aa53-eaa43dd4d805", "value": "6144:Krhz1OzoafoayZ4zmuS0N2zZnXbASadIcMjk+V2wZP0fWwNG:KzOzoaf/ByuS0EbASaacMB2wt0fG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659551755, "uuid": "b8729b0f-4e0d-4193-b179-8843add68228", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659551755, "uuid": "8608c2a0-9b8e-45ed-929a-895124de5562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551755, "uuid": "0e0706a2-00aa-4399-9b48-943ae9346ffe", "value": "SecuriteInfo.com.W32.AIDetect.malware1.11057.19080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129d3863-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542719, "uuid": "8f6ca5b8-67bf-42ba-a145-0bfb228aeb11", "comment": "Malware payload (Mirai)", "value": "5415e86dbbc73a12abaf8ac4cd94d031", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542719, "uuid": "aedbfb67-4613-4e64-8c0b-de25d8cd3174", "comment": "Malware payload (Mirai)", "value": "3e124c3b649c65b3eb3896515f788afd4bb867da0cce0fc1b98404c1ec33906c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542719, "uuid": "7e08f69d-89a3-4c8d-9147-cf4527ab164c", "comment": "Malware payload (Mirai)", "value": "6f6de5eab5a34e80bccd5d80c87f834296791985", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542719, "uuid": "cff16fbd-e9c6-4e1c-83a8-cfaa2c7fbaae", "comment": "Malware payload (Mirai)", "value": "1751c2a1618a62b79cba87def055352922d856132a6fb746545993ae68ca5deda5c41a7410f30f0238694d532d0c8604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542719, "uuid": "e183d1a6-f42e-4b4d-9b72-b20d81af11e4", "value": "T11EA2CFB8B6B97C70C2B19572DDBC1805B2175A7926F671311820C7A56EC320A33B89DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542719, "uuid": "c9ab68b9-a705-4bcc-b99f-d70416ed660c", "value": "384:ofmu7YtXl3lZ4G6pIsCx5QQ3dqDYBMyLWNtV7dokwhymdGUop5hQ:of17YJl1ZrcSdqsewWNzJjws3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542719, "uuid": "72a12b6e-7cae-4b89-b359-594192d9511f", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542719, "uuid": "a5fc1dba-f591-4599-838a-46cf61d51f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542719, "uuid": "eab2dfc5-fca8-422d-981d-ca032f43adeb", "value": "5415e86dbbc73a12abaf8ac4cd94d031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355e9f48-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511854, "uuid": "97f47fda-2477-4288-8a90-1b58d80a3930", "comment": "Malware payload", "value": "5b0b837ba81580f46c68f767a74ee4bf", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511854, "uuid": "7fcb8c2e-fa77-40a0-afae-c8fc4f8f04f9", "comment": "Malware payload", "value": "3ef3e9e77aaf1bddf0277795b1d7294fdc5a6629485ca13e0432fbca14942998", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511854, "uuid": "c720b6ac-2653-4888-af87-10a2131ded69", "comment": "Malware payload", "value": "7fac40e0845dc73eef30c7f1fb8005e9bb21c84d", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511854, "uuid": "ac127f80-25b8-46c0-865f-45d640ce3f78", "comment": "Malware payload", "value": "9b3c5ef75fc7b37cab0d30041a2c5caedb3abb55a4ab5c25c28d9fb8ad5c696f6a1b5ba68726fb6d803b74f7457e87be", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511854, "uuid": "c31d551d-a7cd-4876-9926-0db5b99a1b91", "value": "T11982E220B57AB1DAC77BE530F54B9E073B2B5283A1654783336B202F14A3907D13E9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511854, "uuid": "68c768a8-c916-46bd-8918-c8d522620222", "value": "96:Qz/wwtE28Y9KZe9cc3KYbIA9SSQEcnDnsnmnmKlnHl0AHNrCCeYFCxhOXn9RSRYk:rn/J/A95ADsmtRMcapzdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511854, "uuid": "ba367b50-32d8-4e85-bdfc-ad7ba0594217", "value": 18293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511854, "uuid": "662c670a-05d3-4736-bba6-b86ba6a8adfa", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511854, "uuid": "aff37fa7-81ab-40ca-a6be-7e71710aa346", "value": "wdend.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02916ba9-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1659495018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495018, "uuid": "c2778195-8ce6-4e88-adf4-4b4063c0a245", "comment": "Malware payload (Smoke Loader)", "value": "1b5a413bb88ceb7508e5db4aa0914564", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495018, "uuid": "27c636a1-2d72-4055-ae67-2d51ef0e1646", "comment": "Malware payload (Smoke Loader)", "value": "3fe6c3edb6593444aaed9ae78a6164a3c98a10a32012d32c35ca4aa987db2c61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495018, "uuid": "cb23cb9f-be83-41cd-93b9-2fd48db9ac5a", "comment": "Malware payload (Smoke Loader)", "value": "901e05d203bc1c602c2ab960223167b2aabafe2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495018, "uuid": "0b9c2064-a487-4d15-b840-d3c8448d0934", "comment": "Malware payload (Smoke Loader)", "value": "6ead25ee400161270d8af055818c7b6a1aac023a4f2a70e4da50574527ebab6cc4f5525dc2bd8f4aa770b04db9851535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495018, "uuid": "945e5864-5488-41fc-ac4b-ac8ebfce1885", "value": "T15A04AE2036E1C0F1F1B72A704474BEA12BFBB9626774468B2FE4162E1E712C05A7975F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495018, "uuid": "22915fb2-17f8-4340-b5d1-08ef2e57971f", "value": "7b8da7d62de49809359b378ca66a56f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495018, "uuid": "8b16f90e-5701-45a4-b4e5-af6b606008a9", "value": "3072:MVN9/1GFvejeDZ3WC7e+b7fYarAJ+nMpRF/wrhxP/fY:MVVGFvejeD9C+bz5UAMpRg/P/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495018, "uuid": "8c5b0cb0-acec-478e-9e60-39edaf9087c4", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495018, "uuid": "0c0bab97-8780-4aaf-817c-143fd5b3a32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495018, "uuid": "ceb2e9a6-2c1b-4183-af14-69fe2b768d63", "value": "1b5a413bb88ceb7508e5db4aa0914564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ccc5c2-134e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659546216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659546216, "uuid": "8ffbffaf-3085-48a1-95d3-6bf0efaaf2a7", "comment": "Malware payload", "value": "f016b685dbdc6037556c37dbfdc4fc9d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659546216, "uuid": "d8ac5be2-e0a3-46fd-a0f4-9a8ed72d6d69", "comment": "Malware payload", "value": "409936126580148f08d0f360ce793a25a9f4ecdb1449e700f6317d2a69cb4da5", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659546216, "uuid": "7e67f660-e036-4d13-8e8c-62ff2f377c37", "comment": "Malware payload", "value": "daf7e0788f9a273fd13b1f80c6b83a818cdee17d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659546216, "uuid": "cb17e40f-6f39-44d8-8bbd-800014859063", "comment": "Malware payload", "value": "b80a20f5b1d653044c4126697851368e955e6e17d6122d45e071cd9db23214f748eb663450bf952d2b197885948f4dac", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659546216, "uuid": "2cd243a2-aeb9-4b3b-a1f6-4866eef7e5b1", "value": "T181A5AE548ACB9749DB3BB3F7579A304369D5A66343180005BE9D340EEFE691CA4F22B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659546216, "uuid": "81379f89-fa4d-4a9e-a4e8-309e2f8b550d", "value": "49152:OpeTf5o0rLKOvGh8+rSOb4pRQIAmUDQDlofX+/E:OpqBoiKBGIX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659546216, "uuid": "f9207814-668c-4ac9-9cc5-80a4a8203ce2", "value": 2207744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659546216, "uuid": "c1e8357c-c8de-4228-a559-23263535abd5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659546216, "uuid": "4c2b1998-66f3-4601-9ec8-3ea0b0f2cc2b", "value": "coupon.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c073d7ae-1311-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659520248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520248, "uuid": "ebe74442-9fc6-4d33-bba3-fddef0e6ccc9", "comment": "Malware payload (Loki)", "value": "529858d05009d73d6c744735d1000ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520248, "uuid": "aa3803d3-75df-4396-ae8e-f01b68bc1b08", "comment": "Malware payload (Loki)", "value": "40be9ee05e7db6ebedafecee2ee687b6f6ac2bdea7c057390488bc056f444ff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520248, "uuid": "8f47df69-effa-4eff-b168-8ffc925c4c36", "comment": "Malware payload (Loki)", "value": "03870bc11896b9a5807e0f55ac0f42401b0ec41f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520248, "uuid": "691f712b-56fb-4f13-8b5f-43da52938c07", "comment": "Malware payload (Loki)", "value": "0d0518ebd33a1caa7d4c18651cba333fd787d5f66bff15767c5d4396170cfcd30b72eb901f76afe119f803762c944738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520248, "uuid": "ef973006-721c-49ea-aad6-0539b5e199c6", "value": "T139D4C45C77C58A7EEF1EC8B08C018A666B221E17D201A54623CB3ACB676F75D1F05F98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520248, "uuid": "1d3e80f6-b28a-4ef6-884d-431cfd7651d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520248, "uuid": "a03ecb04-e267-4dee-ab04-fcc2cf157f6e", "value": "6144:N7p1tL86d6DG4t8NRqQdNc1hr8w6ajxUaVPjEOUTuuNTsJXRbLTfVd8UMbOoUJL9:NztL86UCWEq1R8FwQ5aKoXRh+cy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659520248, "uuid": "d82282c8-0a0c-41e6-b0dc-4bbd31472ead", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659520248, "uuid": "7a98d32e-1fa3-4612-96a5-c6aab9fa97f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520248, "uuid": "83a24ec5-3d48-453b-9062-7280af1de397", "value": "GJ11 CRYPTED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f726ee1b-12fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1659511320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511320, "uuid": "796ca839-252f-49f5-9ebb-fee9bf4a6937", "comment": "Malware payload (Smoke Loader)", "value": "5636dc9d1cace59ce59f3f90c6b4a072", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511320, "uuid": "d906b78d-6616-401d-a7ee-30975bd12e33", "comment": "Malware payload (Smoke Loader)", "value": "4156301c24ad0afc793866ef214780e962413a854a62dc347ed256dc2991c4ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511320, "uuid": "2453905f-94b9-4261-af68-e92602355cca", "comment": "Malware payload (Smoke Loader)", "value": "94f00fdebe5e18ceca34303efaaec7c9dbe5c47c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511320, "uuid": "7b4656b7-c94a-44f6-b16c-b304f436d6d3", "comment": "Malware payload (Smoke Loader)", "value": "eb5e34a8fe2a2ba86ef795953750efe2054ac50ebf8e6ce1a4c7787aa9a2195295894bfbd1041cf41955c5468eb1ae13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511320, "uuid": "61a26db6-c882-47e0-a777-042ee3117a9e", "value": "T18D04AE2176E0C031D1BB197C58B986792A7BBDE2EB74C98B2364273D1E317C09A38757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511320, "uuid": "4b07178c-5d8b-463d-8b56-3ea3757773a8", "value": "16efb6b0368de80f5b2f8ee7ed5ecc80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511320, "uuid": "ef35bd7f-2924-4055-ae76-cdc538164cb2", "value": "3072:vrJVpXMSS1a59qH7mrm8sAWAMXB+NrrJuoS99HIxwKTIba7ZB4PyMEb3KNY:vVSM5MqrvMXmvjS9+mgOZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511320, "uuid": "80e9e6df-f935-4876-b02a-901c7da139ca", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511320, "uuid": "71eb1b1e-5d83-4e86-91a8-0c3f251aea04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511320, "uuid": "069d5183-daff-4455-9024-a1d330e92974", "value": "5636dc9d1cace59ce59f3f90c6b4a072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7b643d-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495060, "uuid": "9a780d26-34bf-4559-a086-a53ed4d75f0c", "comment": "Malware payload (Mirai)", "value": "7bb7dd7593117f74eec8b30bbbf32648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495060, "uuid": "9a697f8e-9afe-4cd1-876a-28088f021aaf", "comment": "Malware payload (Mirai)", "value": "422549f63f59cf5286fcaf2bbdcaad6ec1b908bc2595dd10d7205678d2fb3c8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495060, "uuid": "9cd70d75-f8dc-424f-9f52-303d94c26500", "comment": "Malware payload (Mirai)", "value": "b679533120c938da603e82b4b6b63260f4cb6211", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495060, "uuid": "707bdcfc-442a-4455-ad65-2c2f39025978", "comment": "Malware payload (Mirai)", "value": "28137bf44970687cf4a7e4faa9bf18330910c7d75625539f839b938b74f2ee0c760548b471a6c0fabad49fea1d55551b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495060, "uuid": "7d8f7ca4-ae09-471f-a876-5c9c7fe6136a", "value": "T1DD330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495060, "uuid": "64202ee2-2d35-471d-bdf4-13b9c070bc00", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGi:r/hqaJM53eqK806MHdMfQXoHuCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495060, "uuid": "3a482da8-84b4-48f8-b966-821b62d92adf", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495060, "uuid": "33c5599a-31e3-49cf-a23c-8e8cc3e4dc98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495060, "uuid": "1a589cd0-c1b2-4dcc-b96e-9303292aad8b", "value": "7bb7dd7593117f74eec8b30bbbf32648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78349816-1304-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659514543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514543, "uuid": "96cb32cb-cace-4e87-bec8-34577f94aa87", "comment": "Malware payload (Stop)", "value": "e72c0b314546f8e360db23ad3ee0dac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514543, "uuid": "b0c046fd-d463-43a1-b727-ac751b8920d3", "comment": "Malware payload (Stop)", "value": "4304b0ef20facff0ee35283b974fbae32edacf7a8117254fb1a95560dd2a49e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514543, "uuid": "4a2745d9-3b37-487c-8485-6027b540aaae", "comment": "Malware payload (Stop)", "value": "039e6c9b453d194a440c1772afc9254dc26e1510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514543, "uuid": "d26b96ef-6ece-439b-afa4-e1eef456d70a", "comment": "Malware payload (Stop)", "value": "7f6e940c31c4cbdbefa4c28b25914a842465271e7e801611e4afdca0b035f88860da06f5b6fd990647391b46fc95a132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514543, "uuid": "61d6ce3b-5c2f-482e-ae60-e6165d30ccf8", "value": "T1AE150240BB90D83DE5B316F4BA7683ADB92D3DA1673450CF12DA2AED62346D1EC74207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514543, "uuid": "3d033666-a6bf-4ba6-8c99-6c0300d3d9ea", "value": "8dce72c9fe1db39179f8aff188385a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514543, "uuid": "882adc1d-9a72-438d-92ed-e59fd50324a5", "value": "12288:M62CCcc2/PVo3ylKZOnLX+BsIDv2f8fIW8u0Bf8sa1Syq+Jfv3VTS7Jd57Q:tyu/myIUX+lDC28Nf831Dq8SV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514543, "uuid": "597608f8-31be-46ce-84d7-54aea076ace3", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514543, "uuid": "531b3068-b658-4b31-9cfd-8515824535f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514543, "uuid": "9f5d2524-002c-46d1-88b9-23886d3e171f", "value": "e72c0b314546f8e360db23ad3ee0dac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad8be62-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659539083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539083, "uuid": "b9078c5b-cd6b-44de-a386-824f8b4a0278", "comment": "Malware payload (SnakeKeylogger)", "value": "27e8b79b47579fe70f47f66dd2eaa283", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539083, "uuid": "0e724771-9383-4cd6-95dc-a2a0f6c85979", "comment": "Malware payload (SnakeKeylogger)", "value": "43abb6481fe5d96a7e53ba71df6966c0738e2d1a6ea11a727ab79a7c979532d7", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539083, "uuid": "c89d6f83-983f-4e5d-a733-0392832412b6", "comment": "Malware payload (SnakeKeylogger)", "value": "f3f200db45fa1f5a88e049f7fe32bd5f16b8e618", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539083, "uuid": "fa3767b1-8474-493b-83c3-23d1d849df66", "comment": "Malware payload (SnakeKeylogger)", "value": "9708f4ec483cd0810f950b2267418ea3ef46b85b77d0bc849c5bd83cb60eefebcd9c3c75ab98028593ec8f6f1b5dc60e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539083, "uuid": "316ead6b-8ad4-4a49-aeff-5045c60b413c", "value": "T11D83E1C03D66D31DE5AEB7700C837F9C05607EDCBAB992922692B98DE235443C838769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539083, "uuid": "2f9c4e33-c1f4-45b9-918e-672c427abc69", "value": "1536:50sHVVvehYBJS9viEy0+3ATvaDMoxFOltqm44qFnlpttAWzzispP:5tfveGjSRyNUIxFAYm4z4Wz2s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539083, "uuid": "1f2039cd-818c-47f3-99ac-5ddf28062a71", "value": 82904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539083, "uuid": "85010536-96d5-4e21-b785-abadf2b26746", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539083, "uuid": "e4626f82-3784-498a-ba35-adee827832c4", "value": "Deed office Document.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f7950a-133b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1659538326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538326, "uuid": "8a59396d-bf36-45dd-9e3d-0cfa4dc0f5f0", "comment": "Malware payload (Socelars)", "value": "c521a65d11dca76a0ac886f15e0ba15b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538326, "uuid": "6d1b7fe5-8051-48e4-9873-a34a46dc344d", "comment": "Malware payload (Socelars)", "value": "43fe43a7462d892ae08bfdb50dc07249796bf90631a4975ea75738291b484f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538326, "uuid": "8ed0bf06-00e6-4b7b-ab11-23269b60186e", "comment": "Malware payload (Socelars)", "value": "56154763cc5c5073682c583ee86e99bb2dec14d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538326, "uuid": "9ec14467-04a9-4017-ae8d-048bff5854ca", "comment": "Malware payload (Socelars)", "value": "71b5365e274d88592c08dd3bf8f5e85c3e437f56ec191dd9181c19ef2c6dc819a7231a776cbd590c05ee12ff498a9ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538326, "uuid": "dbe2669a-15c1-4cc9-bb4e-7fc4695ce5d8", "value": "T12E659F11F642A036E9E300B282FF4AFFCD28B621131854D7E3C45DA95E615F27637A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538326, "uuid": "e21366d0-0e70-48e2-9dbc-c23b66f04dea", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538326, "uuid": "3294c8c7-49ae-4a06-831c-3cbbdb657706", "value": "24576:6sLp0FasdJu/+/dfMs2KLoyaU/5DeTgtMyPtTohzo/Kf4d:npncZO+HCyPtToJoCwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659538326, "uuid": "4bb2f099-e1b9-4f1f-ab10-949b73dabbe9", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659538326, "uuid": "57f32330-fb43-432f-b509-8786d15ce803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538326, "uuid": "a64cfa82-6bba-4a5e-ba71-6e8224382280", "value": "c521a65d11dca76a0ac886f15e0ba15b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbaddd72-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537956, "uuid": "df4fa3cd-f4f6-4a82-89a8-4732731835bc", "comment": "Malware payload (SnakeKeylogger)", "value": "1831db8cab90268d991da0c460d76c79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537956, "uuid": "6aefcffa-3bdc-45e6-adbe-3f6fa20a1e24", "comment": "Malware payload (SnakeKeylogger)", "value": "4446b7d6da5d2cf21e1631e4d45cb9342dd5112de2b1124be027a80d5640bcf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537956, "uuid": "af42d301-3aa3-4db9-a6db-61b26a92e894", "comment": "Malware payload (SnakeKeylogger)", "value": "ba4ab4df909923fc3f966686c8fb5fa8272bab71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537956, "uuid": "4021abf4-cfc7-4539-a096-ce5cd54973c9", "comment": "Malware payload (SnakeKeylogger)", "value": "52971d94a8d7a27aa06754acc74e3c64643f889912da31030914c4197b91631adf2efbe80f8a363924a4ed86491eca03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537956, "uuid": "2f44290a-e4b6-4583-a348-341cc7748a59", "value": "T1ABE4CF50B5B88B62D66EE7F8A87421502BF0BC26292AE3487DC534DE0C73F544E76E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537956, "uuid": "bf9d7374-e2ab-47f4-8eb3-cf32828f70e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537956, "uuid": "b70dea4d-73cf-4adc-abff-9b4ffa9f0ad5", "value": "12288:mH0Cxg+ugGpOWxceOGezinKyPnU9KGhj5MSr+3huq/:mUCxgPAk9OGeWKqUkGhFrrUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537956, "uuid": "06b157dc-83e1-4eb6-98df-56dd89750b28", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537956, "uuid": "30d2e662-169f-4fbb-80e3-bf7e4b594f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537956, "uuid": "7124b316-fbd9-44bf-a14b-6a888a026bc7", "value": "1831db8cab90268d991da0c460d76c79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e8ce76-1327-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659529630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529630, "uuid": "c8394834-4f90-4927-bef6-6bb4ef7822c9", "comment": "Malware payload (GuLoader)", "value": "d4ba00fd6923fe177c5581c296a05fb5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529630, "uuid": "06bcb3ac-950b-4a17-b967-9b06a5f4f8fa", "comment": "Malware payload (GuLoader)", "value": "44d9fc4da5160a57795f1d1f5dba4eba484c53b6604a1fd656dfc72032713676", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529630, "uuid": "42d63650-5bd3-4d01-ae75-1f68240a7f44", "comment": "Malware payload (GuLoader)", "value": "6d59e5c44b22327f782a62f8cbbf4160e6d0753a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529630, "uuid": "3a1c5340-92c7-4881-9dec-a9ec86a6560b", "comment": "Malware payload (GuLoader)", "value": "0709503a16d78acc29b209bed3dad937c36357838ed1d6d9df390249d4ed8399cd8a1b87661ef680c297458af8bb6028", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529630, "uuid": "2ce3c160-7c4b-4db2-b50d-f914ada25d0b", "value": "T145227E2CC904E91FD520047DE06A82F9F73D81A7E613B51A115572CD0F61AC357CBADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529630, "uuid": "5a0049f7-8e85-4f3e-ae14-f72f276c4022", "value": "192:ScIMmtPw3nb2QNjSG/b1NEpOg3F5SEzBC4vNq6sU/K6Ga3hF:SPXQnKeJ1QOg3LhlqQPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659529630, "uuid": "36a78d0a-fbff-46d9-8384-b753fd4a74d5", "value": 10340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659529630, "uuid": "75fad226-0805-4cc2-bf2e-c604fd8d5f41", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529630, "uuid": "147e59a9-75b8-40e9-9a46-8137d677e2b8", "value": "Sipari\u015f Metak_WJO-001.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdefafc7-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659557717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557717, "uuid": "8ec9e27a-2a36-4ce9-b490-db04a3f59254", "comment": "Malware payload (Stop)", "value": "d978987029ea2167d491d0bdbb6863cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557717, "uuid": "39608681-0e12-4178-ac2f-7dc1239d9d99", "comment": "Malware payload (Stop)", "value": "44f86f232d97fc48c4811b94603ec9adf7944174ab065f4f41a5680d30854829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557717, "uuid": "77480c5b-acbf-4977-9962-b805b33eab1b", "comment": "Malware payload (Stop)", "value": "daed6dc5573805690717fdb54407a23d65937212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557717, "uuid": "2c71b894-6fda-40d1-b5b3-85c63fb9d59d", "comment": "Malware payload (Stop)", "value": "1ac2b1e5134cf45a4940bf178ae6a707a997efc2497ea53944b28f2592b00d1924498e11ca3189e8c491c0897cdb4026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557717, "uuid": "ba5461c6-808a-47b7-bf88-45d962e4d9e6", "value": "T16AE412253EEDF071E5E72470896196B16A7FBC3237B05CCBB3430B2ADEA53804629749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557717, "uuid": "af49edc3-a934-438c-b513-e2eadc59e8e3", "value": "a8692768e915e3ee244bd5d51d7bedfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557717, "uuid": "822588de-d9bb-42ff-b096-fd2f76dcf427", "value": "12288:5osQFtDg/iRD6MbyAM3TnW/3OI8RRwkLHRl/6GAhRQli5qwTgb8vJH8rWu:5ozGiRD52L3TWWsan4FVgY8Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557717, "uuid": "137b9607-65f6-4992-a4a3-ba5dd6da09b2", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557717, "uuid": "8f9f901b-8000-489c-89dc-ca7ed64f0969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557717, "uuid": "cb8c5989-c1f3-4209-81bc-b23507f4f3ce", "value": "d978987029ea2167d491d0bdbb6863cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4713bb0-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537944, "uuid": "5407036f-021d-4966-a725-d52a857b99c1", "comment": "Malware payload (SnakeKeylogger)", "value": "0cd22c965de8ae3d90b39dc61b0625fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537944, "uuid": "31eaa3d1-002e-481d-86a0-a05d56f79ac0", "comment": "Malware payload (SnakeKeylogger)", "value": "453c4428a96285bb2b64c8cb37679f8c9d48d6236fc4c682e2a69aca658dc562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537944, "uuid": "1fdbffcc-1c20-49d2-a58d-e530b390abf0", "comment": "Malware payload (SnakeKeylogger)", "value": "4e3885d08b1aac00b1a3cd25bddf196ee1defb82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537944, "uuid": "66127a1f-8709-4652-be40-c6c4da2dc5aa", "comment": "Malware payload (SnakeKeylogger)", "value": "7ffd82245c2cce3290cd1f540014df001862a6289ecb35e4f3aa93d26a37b45dbe6d67831baa3e6f4528cab52ddc809d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537944, "uuid": "ea473518-a39a-4ac6-ba92-28726fb8ce26", "value": "T106E404897266FB05CA8D89F70813BDDB9D31E816B481F7A452B0D73FA42C874259B8F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537944, "uuid": "84a4c684-d83b-420a-b3b8-59eaa507b907", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537944, "uuid": "28f88bb6-1154-45c1-ac08-f959da71ca6a", "value": "12288:fq+TC7OZzEMnUngsylJgbCqvoX1LX6mYD7Lf:fFT5AMnUnXyIGLlLqmYPLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537944, "uuid": "c9949f99-9d4c-443b-9ade-fc400f466b80", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537944, "uuid": "0012abd4-f059-48fd-b8a7-0b9fbd799f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537944, "uuid": "1ea6f994-7355-49fc-98ec-406909ad5ac9", "value": "8988777775356356636654455666636636663993666366.PDF.ZE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590b2f01-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537684, "uuid": "048b1213-072b-4be8-a292-37bad0780e98", "comment": "Malware payload (SnakeKeylogger)", "value": "1300fa11a9d3a9db00c90d1166736810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537684, "uuid": "0ba4a6d1-340b-4686-9d1d-46c0c5ba463f", "comment": "Malware payload (SnakeKeylogger)", "value": "458787a4edcc3d5b67ad7cbe721addd3879872d25c90f9399984e02a9038b9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537684, "uuid": "8c7ac0a6-51d4-4d2c-95f4-e48eca23ffdb", "comment": "Malware payload (SnakeKeylogger)", "value": "a310e1bda6b4bf0e8c9f0d92f81db89e493c83c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537684, "uuid": "c483a220-3360-4541-b6fe-7ef9d6d67cac", "comment": "Malware payload (SnakeKeylogger)", "value": "ea2a1b0d820c1890ea651d298b85e545161e1a355ac6ff6ff658271ada18006f4262a154c9ebfb3e32010e21a4fd0269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537684, "uuid": "3df542a4-0a1e-4270-b5a5-162f8626746b", "value": "T1EC257A8D7207B38ACA9D99F70953BCCB9F36E805B595F2851670E73FD95A421208B8F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537684, "uuid": "10c3b420-0d98-4e1c-be77-c8fd51c8ce4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537684, "uuid": "9f10c554-c57b-4e2d-af0c-3c2cc4ac7d78", "value": "12288:sI7kfGzKGZAChekodyIdRCrXFYTnKle5BOdi21hyCeOXECHOBuBZpKZoI3L0H6XJ:sIJ8TLC7r+BOdiqpRIwH+hSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537684, "uuid": "b53ee701-59c0-4789-8bd6-57ec0558358b", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537684, "uuid": "04b9f309-bc5f-4d10-95dc-0dd8bf41efe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537684, "uuid": "fc0e8ddf-92b3-4548-861f-2eed3bb8b9f3", "value": "Ayczxll.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8f24d1-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522526, "uuid": "6d3f9091-582b-45c1-b887-4b47d82d530c", "comment": "Malware payload", "value": "668951cdedc8d7a87ecfdce43602cc14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522526, "uuid": "edfcc7fb-8504-4269-9cf0-ab305e795a63", "comment": "Malware payload", "value": "464cc5b5b281c2e7fbf8a4b5b944243605c71cbbeb97faff10bdd6d89951dc3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522526, "uuid": "ce5f156d-55a8-4861-b4c6-8b2884fae55b", "comment": "Malware payload", "value": "f4a9ec8351ea64663ac0daa9f1a3faac6b3a4372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522526, "uuid": "bf8f8e7a-4152-43a6-a2be-6d783c45b98d", "comment": "Malware payload", "value": "a6651fa339aab4749420d8b6e822ed23b3443d42656bc31e2fe4fd5826246cc531e3381ef35cbce8b8d9136acf1a2e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522526, "uuid": "bff7e5b4-f2cd-41e0-9037-bcb19169a8ff", "value": "T1ECF5CFDA21503368C01E48385433AE09B1F1961F4B95D5EF76DBAAC067AF8D1E936F0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522526, "uuid": "22674290-ff9c-42ec-b65f-12ac8048f0f2", "value": "5e4d6ff903bbbbd2b4a3402cd209d7e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522526, "uuid": "ab4823fc-c0d0-4dda-8e99-338cf0d9beba", "value": "98304:+NRgh/x/t7NWq/R0vDf7gf5p9BW7T5vx8L:IG/xaGR0vDfs5dW7Bx8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522526, "uuid": "cee0745f-4f99-4f11-9f8c-58b44d893c77", "value": 3560080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522526, "uuid": "f2646314-c463-48f4-b560-c7f254704418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522526, "uuid": "1dcf138e-3d0c-402c-91f2-02038add668d", "value": "464cc5b5b281c2e7fbf8a4b5b944243605c71cbbeb97faff10bdd6d89951dc3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d56232e-132f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659533047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533047, "uuid": "a47c0140-a2a6-4bdc-a931-e63f4e67d275", "comment": "Malware payload (Gozi)", "value": "f6a83fc0075e66391e5511de2fa10a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533047, "uuid": "b4f78daf-2b75-4ddc-a901-b9aed67f31bf", "comment": "Malware payload (Gozi)", "value": "488925a89527506e1e40d24e0599e758bcf44bdd788f9da852823c27898d164e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533047, "uuid": "256b2f04-aeb4-442f-87ec-7ab4ebddca79", "comment": "Malware payload (Gozi)", "value": "0711fbea9edef5179f2c7ac7f25014a127bf06eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533047, "uuid": "b54284d4-6022-4962-9024-ff4632b956a3", "comment": "Malware payload (Gozi)", "value": "1212be42704a12f4daeebfce618417ba9dcdecebb4ab258304a07f1480b3c6bcb57ee3319e3c0304a6886779cb05df80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533047, "uuid": "54dfeaf3-e7d2-4827-ac9b-9e53530e42c0", "value": "T168345C5AA3E51995ED6BC6B6CD53D227EBF234092B24D30F5370CAA66F17722B11C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533047, "uuid": "9add6d7a-da0a-4f6a-acfc-a045ab855160", "value": "3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjJT5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659533047, "uuid": "ecf78996-b98a-48b9-9d1e-a0e9854f8f42", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659533047, "uuid": "c9d3f511-1ba8-4a2a-83a4-8fa2cfa30402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533047, "uuid": "0965b04e-0f48-42da-9bff-bda86548da9e", "value": "c6a0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46b352d-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659539099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539099, "uuid": "031c7ae3-9b4f-4ec4-a812-57c9ae46824b", "comment": "Malware payload (Formbook)", "value": "6565a52a57f9216e6375b8d4c24fca60", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539099, "uuid": "be71175e-1b10-4ec8-b5e1-f5d0becc4c2d", "comment": "Malware payload (Formbook)", "value": "4896f17adf04ba24fa3f0e6651dd7a99c84f372641d114e6679a387f02ba34af", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539099, "uuid": "8b123f86-3322-472c-970b-e96147659dcb", "comment": "Malware payload (Formbook)", "value": "5f95edcf0bb7f6295c6cd1fbd6e076dda14f9592", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539099, "uuid": "1d9c12ae-c8b7-4d5c-bbfd-01d708f9054c", "comment": "Malware payload (Formbook)", "value": "8ff73ff4930887840491b12ae09373c440281022c71a4cae3bba570a28cbfcc5240e81f7cf9325cee290e60f6d05d1b3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539099, "uuid": "00e16c0c-674f-4075-bf39-934900fce9ec", "value": "T1E4E27C9F23B4813BEFE262776AEA49273CDA1D0C455CD782F7B2325919B1092512DF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539099, "uuid": "da6920e0-0719-43f4-b452-43edfbdbb5d5", "value": "768:A3svJ4ehNqCt1gEKPv0JLSmbcdZvHiz+W976Qk2WOUHuMjDv:A3EdAY0vASmQd9CCW97qOUOMPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539099, "uuid": "e10ad574-1ea8-41b6-b508-681a38e09d6d", "value": 33432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539099, "uuid": "d754b635-a231-4fb9-9e1b-de4e66e5c8c1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539099, "uuid": "0adda311-3554-45ef-be1a-23f82efc6981", "value": "POL_SHAHEEN Project S-oil .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbfaf5e-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659557339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557339, "uuid": "037a2063-bafa-4af0-960f-fbeee15d322a", "comment": "Malware payload (RedLineStealer)", "value": "d5ce66cff745e42bd0ee76c24ea2f0ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557339, "uuid": "a4c56400-348e-47ae-b877-03d666dc6acf", "comment": "Malware payload (RedLineStealer)", "value": "4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557339, "uuid": "6a2feb1e-dbf7-4df5-a2e0-e036ddda51e1", "comment": "Malware payload (RedLineStealer)", "value": "b0f858aecc8a0ec781ecc7565cd03018ee280554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557339, "uuid": "7e5d7488-f2dc-4345-85a7-4a897186c63c", "comment": "Malware payload (RedLineStealer)", "value": "f256055911289a891ad883f5e7ff0eec3364a9c15e6580333f7cfac577ceef31f42949ec42334015b4ae96cddeeb400e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557339, "uuid": "57e1ab4d-0e4c-4882-a33c-8741c63d8e07", "value": "T12654E02177A1C472E5A229308ABC96E17F7E792327744F8F7314163E9F602C1BA74366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557339, "uuid": "56237ca3-6a88-4107-b949-8b06d32ffbcd", "value": "ba3d499d4d95678ffdd9252ddd2d1d74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557339, "uuid": "e898b3df-6156-4a15-bcdb-91e6f74ac769", "value": "6144:w4TNI38goXJrEcYU9siuMj/LeKO3XMsz5:wzho+UDnSKOHMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557339, "uuid": "df1c6b53-74c8-47c6-8956-a8c772c03dec", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557339, "uuid": "05435fbb-73ee-439f-91e8-c5a02cdd6d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557339, "uuid": "91b3bd0a-1b82-4005-9014-424029597716", "value": "SecuriteInfo.com.W32.AIDetect.malware1.32713.27440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42859b88-12fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659510158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510158, "uuid": "b83c19eb-cc66-4aeb-b201-1229f534245f", "comment": "Malware payload (DBatLoader)", "value": "cd3aacfe675dfa4fccd2ccd50e52c6e7", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510158, "uuid": "e597b840-8a63-49f8-8451-b11437a15f6a", "comment": "Malware payload (DBatLoader)", "value": "498baff52ad2a419108074d90b6eb085afcc91ee2a881dd78aa37185779243d0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510158, "uuid": "c88ed7db-8915-44c1-abe0-3a2326854534", "comment": "Malware payload (DBatLoader)", "value": "7b21f59f6783b0f433010b0cabe4c8d2c66328d9", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510158, "uuid": "8cdc1a21-d82f-44ac-bea7-40fec6bb10f8", "comment": "Malware payload (DBatLoader)", "value": "b8c043eb6d7edc8ad28bbf1e22adec3b2446ad911e11fc44982fa61f4b1a779c4d71f001dd5b2c3df960626d27cea20e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510158, "uuid": "bdd91495-d55c-452d-a114-7db3be703de3", "value": "T188758D36A2A0C437D0A32A749C0B57F89D27BE51293498463AED7E881F377613D713A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510158, "uuid": "2e014426-0c43-41b7-bbc9-fac16893ddad", "value": "24576:Oeq1bWjPd8Y5Q0MFxdNLdFRlz8d52Ep8rOU:OeLValFoorx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659510158, "uuid": "d27b9ab5-84de-4365-8ba0-c665fae166a4", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659510158, "uuid": "75804720-d9ca-4412-8dca-f8b3e49f091b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510158, "uuid": "f0f11e01-b551-4606-8041-4a116f5b7939", "value": "New Product 61844-M and 61844-MA.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8419d7-12ed-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659504831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504831, "uuid": "805f7d9f-2bb6-41cc-a045-50f3702570d1", "comment": "Malware payload (Gozi)", "value": "7906839107827694886393a2b182703f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504831, "uuid": "b986edb3-2107-426f-bac9-b11957a5a8d1", "comment": "Malware payload (Gozi)", "value": "49c49596991b27938d7eb3d5fef09f50e6c74d978293a49410ff22b38a50d45b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504831, "uuid": "6d42e106-1186-4209-9560-2854700e345c", "comment": "Malware payload (Gozi)", "value": "2c3fd000627ceca97f7efcd6b425ac6a4d3f6111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659504831, "uuid": "de58569f-e820-42e8-ac96-864667fe93b1", "comment": "Malware payload (Gozi)", "value": "f6d23ade43028e8218ef3ebe49c8d1b4f316ebaec658b277b908db9c0e6b3c39c413002846085ee23395f9289ba1d4e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504831, "uuid": "ee9e4895-d18b-435a-bb6b-4e08898071f9", "value": "T100749D00B7A0D039E1B302F4BA7AD3A9B52E7DA1572414CF52D62AEE57346E1EC7530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504831, "uuid": "6e747644-2938-41cb-b9ce-85497e2d7683", "value": "7b13e4090c99826947262651b64e9d68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504831, "uuid": "55938c08-8eab-42e0-a37e-8f2656acb0e0", "value": "6144:WgKJQYWuFhFpbAC9Hkt/g41qd7N9blBuKbD5evYO:AJZ7pbr9HkVg41ELbhJevL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659504831, "uuid": "848e58aa-de32-4438-bd5c-f8801f2ebf39", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659504831, "uuid": "d6a8dc97-7492-4344-aa32-0a32c2caeba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659504831, "uuid": "59df5838-4149-4adb-826c-807f5ab45b29", "value": "7906839107827694886393a2b182703f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c0d57b-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522505, "uuid": "39cdaa8d-b55c-4db5-8577-2c4b2c2f2b81", "comment": "Malware payload", "value": "22ddca1580466c1bcc36948ba910b52b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522505, "uuid": "91bb6564-c8c1-421c-b4ae-1c1d1b2dbe91", "comment": "Malware payload", "value": "49c51e75d38997d19b9873f86b832631dbe4f5e48260240bbd89530bd8f7b439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522505, "uuid": "543eb018-2e90-423f-a49c-907083eed469", "comment": "Malware payload", "value": "459d6ab771ba2f9683df5845ef77e22af3b051dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522505, "uuid": "2308e614-64b0-4bcf-88ab-6580608fd789", "comment": "Malware payload", "value": "4e89b31b8da44bf5c4f727a2c0236590b8bf676f6d8641b9bda4768a5451fcaf100507b862c040baac18fcf3bb464948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522505, "uuid": "d580cd57-cba9-45b1-8e9b-1ccf76ca37a6", "value": "T18AE5BFBE2258339CC41E88305037FD44A1B6562E5BF895EF71CB7AC06BAB4D49932B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522505, "uuid": "3636ac4d-516a-4eeb-9070-87deb35bed0b", "value": "912f573039ea08a77db7f423ad537e23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522505, "uuid": "883b5f9d-0733-437b-8e80-5f0190623833", "value": "49152:g8KzA0nfZjJdwASBxm0AREhYALdef/cd9pRoFAKKw4gXXrbC2Wq4UOKj4UA:3KzA0nfZjJWBonKReXKIFTygnJOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522505, "uuid": "c6c5387b-a8e6-4448-a0c8-70914189a523", "value": 3210224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522505, "uuid": "9b2d5965-ca61-416a-9074-11dd04e90f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522505, "uuid": "8c3239fb-1940-4702-89e0-351050ff7634", "value": "49c51e75d38997d19b9873f86b832631dbe4f5e48260240bbd89530bd8f7b439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dddd1c7-12e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659499359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499359, "uuid": "3d4f7c1c-60b0-4c19-bf0c-f03b74e00c91", "comment": "Malware payload (Mirai)", "value": "5a4fb5e7911a288d3e96a473f734844f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499359, "uuid": "125b0311-62eb-4a0f-b239-8ae4930ba7d3", "comment": "Malware payload (Mirai)", "value": "49fe10050736eff50d031417cfa14fa341799fef008c4ec785123c94c0fec211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499359, "uuid": "260ef8f8-3507-4945-958f-2b6fcd426d5e", "comment": "Malware payload (Mirai)", "value": "e56545e3dec067943005f8d400cf66704b58b630", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499359, "uuid": "a45a7dee-c5ba-4f6d-9f44-f26c9e5a5db7", "comment": "Malware payload (Mirai)", "value": "7311ad9c367be2d5909b001fba1918080558633bc38172fd0bd60f66392156859a61c7cc232ad28bf22455c2086021ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499359, "uuid": "8ce800cb-5d36-49c8-83f4-7d0b39f08712", "value": "T1FD934B9AF800DD7DF85FDBBA44230E09B531A35576930F3A569BFC537C720A92922E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499359, "uuid": "9940a824-2377-4f0b-9c02-31a4e820c437", "value": "1536:77w8LZe88kkW+WXeAJPDmVYPV8z8zsyWq2hUozVqisuibM0PBFq9nJ:78eZe1DiPPDmCPV81yWq2HUiFiobnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659499359, "uuid": "b701227b-015f-43c6-b980-97f4c3092b85", "value": 93012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659499359, "uuid": "17234d87-bf11-4ec1-8151-a86d270fbf7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499359, "uuid": "a0c8098e-e528-4805-9697-a41a777e81ea", "value": "5a4fb5e7911a288d3e96a473f734844f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b738c1-130a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659517332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517332, "uuid": "f1c3e19f-4080-443f-84a0-fcd797c63796", "comment": "Malware payload (Mirai)", "value": "1ead0efa21714b799a2448d70c4dc595", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517332, "uuid": "0ce96b00-7ca5-4ae3-9943-aef2151eecf6", "comment": "Malware payload (Mirai)", "value": "4ad6fc26f2166199cccdd54bc96bc0ce623143d65c27016dfb4f81d11913be9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517332, "uuid": "45ca5779-565a-4e03-b62e-5ebf925440fe", "comment": "Malware payload (Mirai)", "value": "2d14227234d7180f0c6fd78350847d747f5229d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517332, "uuid": "431891d4-3433-4fa9-a436-20bdda3e9ab8", "comment": "Malware payload (Mirai)", "value": "a484fc34e177db295feeae88b74539d0c7824efd942cd8e66274df2edeb70983634051f1267e8e97c0332c93b513198f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517332, "uuid": "c6d1bdc0-ffb8-408e-91d6-1a4173fe26b8", "value": "T13DB2F16C84840F05DC5B41FF9ABE05EAD6A184834AFECBD55F671CC3E2B78A2791C614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517332, "uuid": "eab85d93-5e8f-4462-8f96-0071659ccab7", "value": "384:MviiBi3f2PSrf64K5WFSlvNjJ6mAN8bhmglJbN2EIKHT0P6+PbhDYOK6sNrPWpT/:BiBiv2PSbePxNNw8dtlJwEIGT0P1Pbh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659517332, "uuid": "472bc80f-fe6d-4920-bd33-9ad0ebdf94d6", "value": 23432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659517332, "uuid": "032f4beb-15fa-42a7-9206-a5e3e774b898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517332, "uuid": "28de4aae-9b6c-4466-841c-ec48d052f100", "value": "1ead0efa21714b799a2448d70c4dc595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302eb739-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659542340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542340, "uuid": "83057e24-0fea-4cf3-a189-03e878fc50fc", "comment": "Malware payload (Loki)", "value": "365ddc5b2d672f30d9643c156cdaffd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542340, "uuid": "91fc5770-fde9-4a8d-9597-cff25a762eb4", "comment": "Malware payload (Loki)", "value": "4b249c22e7f58e42ded722d213811e4ce8245a8fd9fd0a84b8ea4b2b7e29d35f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542340, "uuid": "0a5ba8c1-6785-47d2-92a4-51e4f2bb3b33", "comment": "Malware payload (Loki)", "value": "88f64fd6895bae43acaa643fa61e50bc007e1272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542340, "uuid": "00daacd7-e448-49ff-8ff6-199ba27d3a62", "comment": "Malware payload (Loki)", "value": "d7ceea7ed2c4d228067ed01107e7f352e5a5d5a8b3b60c85dd5d01634f34c6bd46d5a785dd386385d64b93e835398bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542340, "uuid": "03d1786b-3ea3-4952-857e-b7e773a7a394", "value": "T1EFD4128166BB8F23E8B66FF7F101808903B1722B6472D1884CDA3CF79576B530A6165B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542340, "uuid": "b60a0e2e-aadb-4e55-9b5b-9298909026ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542340, "uuid": "5c59b05f-14c1-496a-9d4a-8ee981ccbfc0", "value": "12288:x8Jg6SKlpxir9kSO4y8hvoMK/B7jQQosh7:ILlpxs64DAh70QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542340, "uuid": "457dd839-5ece-4692-b11c-5935d57b3097", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542340, "uuid": "ccb9f27f-e514-484d-8e64-1a28164ef8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542340, "uuid": "978adb92-6f04-47c6-af3f-d99b4256c133", "value": "scan doc_22190890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d795737-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659557341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557341, "uuid": "15a914dc-43f4-4f30-b263-92758e555581", "comment": "Malware payload", "value": "2e0e0203e066ec72a796d93709933a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557341, "uuid": "1bd3a2de-0e8f-44f6-9c40-99b278c34c38", "comment": "Malware payload", "value": "4b8d5c7a726e4489e3e527b36d433a23a225bbb32a45dca7b2e3f7786e8beb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557341, "uuid": "93e5dd7f-90e6-4ff1-82a3-fcf82c4399c4", "comment": "Malware payload", "value": "691e8d0ea4b0cf3c65b432bc6c7c8240febeaff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557341, "uuid": "890f83a1-4818-40fc-adfd-be55a4a8c9a6", "comment": "Malware payload", "value": "f3311c9b7b6b5798c0d9c8ef5d3f3da6ef1ce225406264c915c8e0adef62d9910e1b75efac917540ec024d62e9f1d6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557341, "uuid": "ec4f031e-ec63-4539-a360-86841d3fc12d", "value": "T114E49D1022D5AB58F0399B745AA0D03047F6FD16D239E66D7DD83D8BBB32E408A63727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557341, "uuid": "8fc3021d-57c1-4695-85f0-828d6c4448b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557341, "uuid": "79663597-bb89-4a2c-bf15-06e47fae26b1", "value": "12288:CuJpzzH7Omzuj7uWiHzkNiNST1w3op3La3QIGISVPzoGf:BLj+uRNuIop3LXZPzoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557341, "uuid": "93150db5-7b49-4539-8849-8f2d46ad717c", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557341, "uuid": "253a751a-3d04-45c5-bc9e-e34a1b877e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557341, "uuid": "5b20b549-e5a5-4065-bf6e-b36e6d47d36d", "value": "SecuriteInfo.com.Variant.Barys.11488.19269.17001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20452da-1363-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659555469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659555469, "uuid": "9ad5986c-9d03-4be3-97f2-ee38cd147521", "comment": "Malware payload (AgentTesla)", "value": "662e50a2fd86c287fe3630c5dfe75950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659555469, "uuid": "ddb653e2-bc51-4445-8848-0b5153263af3", "comment": "Malware payload (AgentTesla)", "value": "4bfac35a7dc52f9bb6881d0c64511a5be0f27ad3c3e18bc670b3ffd7f75afb31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659555469, "uuid": "63f1472c-59fe-4486-a43e-ec8842f31ed0", "comment": "Malware payload (AgentTesla)", "value": "c0b99d27f51156cca1400e32871c4a669ebac2b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659555469, "uuid": "73f24630-cc28-47bf-8748-f5921dd0adae", "comment": "Malware payload (AgentTesla)", "value": "4db486095b9748ca29fd85343c51eae8e903b8465b0bf4d59b2be51c586668e42aa59a6c9d8f02b504699ea73110943b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659555469, "uuid": "80938d58-7db4-45bb-a0c2-4808e78094ed", "value": "T17EE48D1022E9AB18E0395B745AE0D13047F6FD17D239E66D7DD83D8BBB32E408A52763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659555469, "uuid": "27c4d57e-3955-4f1b-b36b-b08be40f8293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659555469, "uuid": "0bd6e9d6-7950-4873-867c-51b88321a644", "value": "12288:9Jg7BebedEul7uWibB4w/4vtUxvlWtaB+JdwfQmoI:ny181/4vCxvEs+Jdan5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659555469, "uuid": "d8c63ec3-8beb-4461-85d6-26ca78f3a37e", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659555469, "uuid": "002d00c4-c3dc-44a4-ac2f-53d19daa41eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659555469, "uuid": "11c64d7b-c1a4-441a-abda-32a21e9fedbc", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72be8ae-12d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659494060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494060, "uuid": "016dd78b-3d43-4628-9c31-4aac1ef8502b", "comment": "Malware payload (Mirai)", "value": "f80fab81aae5527e81af418c79c3f9f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494060, "uuid": "b3774acf-2734-444e-90fa-15c8d6253bd2", "comment": "Malware payload (Mirai)", "value": "4cb2f9d787133a30bae5784253bcd41dc76840ec74555d9227d1c5a5b436b61b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494060, "uuid": "5ee6693e-515e-4745-b259-e1206309a9e6", "comment": "Malware payload (Mirai)", "value": "5b8592ec3c76b0ae736ef0e4e93d25f09a9c4012", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494060, "uuid": "23d22429-fb19-42fa-8434-b38e5c16441a", "comment": "Malware payload (Mirai)", "value": "dbbcc7ac6abb7b7f6437a0e9c611473c7e02a4c014b01dc8065e0d5cce7c4097715016a0f48e54a7a32dee1bf268729c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494060, "uuid": "257156e4-734a-4035-b34b-e19accbe13c1", "value": "T15BA2D01562632D56E3ED2C3DC96A8367F9671BFC90F632B569405620C90D24A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494060, "uuid": "e8bc1384-2ba5-4fd1-81d4-178da537cee1", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjewhymdGUop5hW:TvQn4j+ZO5fKAlxiws3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659494060, "uuid": "ef215ca7-029e-4fb4-ae4f-1ef84fe9ac6c", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659494060, "uuid": "76a80130-2837-461e-bd9a-36d7131992ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494060, "uuid": "37028409-0cc3-49c4-abbc-f013d7d83b9e", "value": "f80fab81aae5527e81af418c79c3f9f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf088f4-12d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659494043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494043, "uuid": "2c2face9-b5f2-45fb-9c9f-2070396807fc", "comment": "Malware payload (Mirai)", "value": "af86d738d899d3b231bfff108631da0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494043, "uuid": "6cced4e5-bef0-49c3-8279-492388f1b246", "comment": "Malware payload (Mirai)", "value": "4d2669c090c0740a62e13b37feb3d0115ce7c1d040e3f2cced73d84f0b642ca7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494043, "uuid": "cd46a5d3-3cd1-4c50-93d1-52a519c2aca3", "comment": "Malware payload (Mirai)", "value": "73f04d1a24e13c18c26388131cb5fcd43118fe8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494043, "uuid": "3d9eceda-2e0a-425d-8986-c27b381eaad3", "comment": "Malware payload (Mirai)", "value": "5adbbbdb0fdf85f5b7afcf0c698ddfcc1258ab092ad802ebcb5628b3fdefbf1ab4a781b53a6dca1b508f20e63ba68844", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494043, "uuid": "557114f0-4069-4c1f-aa41-3b2da768b045", "value": "T119B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494043, "uuid": "cbcdbaa1-81aa-48af-9db5-c1aa9ebe9151", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1Z/LWy:c9sSyzz36YaWWgg1Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659494043, "uuid": "2f95ab0b-e5e3-45e8-b0c2-e8c647d6e447", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659494043, "uuid": "b0799b6d-c3e5-43ef-a075-943d2b4c13eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494043, "uuid": "fc8d1164-7997-4073-a50d-70b5425cdd9b", "value": "af86d738d899d3b231bfff108631da0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ad3189-1379-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659565011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565011, "uuid": "55a77144-d2f9-4b98-af0c-d33ec2a1c356", "comment": "Malware payload (AgentTesla)", "value": "01d85a04c4d4128edf54ac10c8bbb271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565011, "uuid": "840aab8e-ea4b-460b-8bf7-8f098c42cff2", "comment": "Malware payload (AgentTesla)", "value": "4d72fbde7c33a03e6bf2c1d7665d67da4d15c379dcb440032a2065065ddd81a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565011, "uuid": "cc270248-f4d5-4eaf-b02e-70e52435faed", "comment": "Malware payload (AgentTesla)", "value": "74d359902a179c77cf4d1ec1e9667c34b285f112", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565011, "uuid": "506ba506-5881-41e3-9fa4-bf3d48bec702", "comment": "Malware payload (AgentTesla)", "value": "bdf8ce9815c1160ef8fe02868fe986249d50383f48b9b5c50559d891a0cbf7d03616cd5f7f87131c103c5d6957635f47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565011, "uuid": "86db7626-fa2c-4dc1-a2b5-723c481e8d27", "value": "T11B35C01472B08A53C96E4BFDA0654A0C23B0A56BB693FFDA275677F94CB33418D006E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565011, "uuid": "9ea44ed9-359e-4bd9-884e-06b73091236f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565011, "uuid": "da8a39b2-3105-4718-bfd1-0174bfde4763", "value": "24576:PzGoJgrUv31wGRFCeI8/t5RwU7x8CEDUP+7jhMfD/0:qoJgAv3/v6U6maefD/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565011, "uuid": "8371d038-76c2-4aea-b86b-a3c320962245", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565011, "uuid": "e5ab1729-9d2e-4249-a520-163dac4b75d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565011, "uuid": "e80365a3-6e38-4db0-9cb5-ed1fd7fd6e8c", "value": "RFQ - ORDER NO. 378126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed8e191-1378-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659564430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659564430, "uuid": "bd8bf9d6-87e2-4532-be8b-1e8112ec1cb5", "comment": "Malware payload", "value": "d44e74832c5df2333bcc48e7b00be168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659564430, "uuid": "305fb49e-cbba-42ab-bc08-63d7d418a7e9", "comment": "Malware payload", "value": "4dae80f07d0039e354443143c0d603a8151a5e0c63cb6b865e004a5bd6f4474a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659564430, "uuid": "51678cd4-a0cd-4a75-af4a-13cf4555abe2", "comment": "Malware payload", "value": "4bd8314dd0f67789b91d7293f51176bfc8ad206e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659564430, "uuid": "ea430204-26df-4c49-bc61-15cd8621cdac", "comment": "Malware payload", "value": "ec05f6f6ab90fa60b8a934a3c8e2e0f020bb0fa273e0e1dbe8fc22871916b8b57b291dcd047c73dd382787afb90d0939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659564430, "uuid": "4bef6f33-5c09-4b43-a613-cc8430502b91", "value": "T154A3E16922B0C453D36306B14EBE1761FEFBD54104AA534F37506F8A3D927C2DA1F29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659564430, "uuid": "c3c0d197-b926-4d84-b691-0fcfb32bbe14", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659564430, "uuid": "fb4800e6-0b2d-4f5c-8651-458e26fb121d", "value": "3072:QFi6z/VXzAf3ocLxbu6VFAeSr0MUIcm8y9QnNK:QxFSFu6j5Sr0nIF8Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659564430, "uuid": "2c45b513-eaed-4ca5-8f95-b748b3512efd", "value": 98768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659564430, "uuid": "f6187710-1af0-4941-a664-de4405502a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659564430, "uuid": "b11d273d-3b03-4f85-9ead-3db089df15ad", "value": "Bridegroomship.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb0560a-1354-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659548754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548754, "uuid": "4c3574fb-faa7-4865-af03-0d266d7171ce", "comment": "Malware payload (RemcosRAT)", "value": "b4c7966345974a5554e5d99fa2800297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548754, "uuid": "f3aea0cd-c282-48df-abe3-3b73b7e32e35", "comment": "Malware payload (RemcosRAT)", "value": "4dbc705f8b2459cd330ba96aac1462ffef090bbb55c6305e49397db8caafeff7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548754, "uuid": "02244a2d-e7ac-4967-aeba-996009dc41bb", "comment": "Malware payload (RemcosRAT)", "value": "933fc5cfd4500f0e755a9e7f5adff60494887abd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548754, "uuid": "43125159-9647-4153-8ec7-848bb72c38f4", "comment": "Malware payload (RemcosRAT)", "value": "5b1eadd6427380c4a914c2b744a045ca3f993b0ba69c466b30418ef8418ab9073b1ac9ed1b859d6f24b2f980bf2acaaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548754, "uuid": "d896776c-7df6-4b7f-8ce2-a5df3f170ef8", "value": "T180A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548754, "uuid": "0154cded-a59a-48c5-b9fc-35690c719914", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548754, "uuid": "58e0b8b3-8be3-4b90-8bc0-04339ef38aaf", "value": "6144:3OFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUjyg:3OFtiNBuFgawDB4NOmuwsfZPsyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659548754, "uuid": "773adb1d-946e-4062-aa51-fd5161050576", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659548754, "uuid": "28504028-0098-45db-84d9-4c5e5c30d9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548754, "uuid": "e77cfa26-29a3-4fa9-8297-e62c75896c02", "value": "b4c7966345974a5554e5d99fa2800297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d5e87d-136f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659560361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659560361, "uuid": "845b446b-89cb-4038-bee8-c676ed8cc1e5", "comment": "Malware payload", "value": "44a1948263ef0a6d25bf07a64cd980e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659560361, "uuid": "c164eeef-4fb2-46dc-9490-be959f2b83ce", "comment": "Malware payload", "value": "4df410d3441d7c839f12932a57492ddb366349c419a3afa936a19d602b1b25e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659560361, "uuid": "8ab287aa-30c6-4f75-84eb-be9d93ceabc2", "comment": "Malware payload", "value": "28b58beb4e114764ce39021f28429bb5c67462a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659560361, "uuid": "903fc41c-0d4b-4acf-b1f0-13cd1f810154", "comment": "Malware payload", "value": "459f53d73577acbf2c88bb261380097befa8a5d6b6f30ef9ab830ec69275ee71ec8d516a2afcfaf67513331a6e5c2830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659560361, "uuid": "6a535b00-ebbd-45a8-82e7-7dfee6d72d03", "value": "T135E47C1022E5AB18F03997745AE0D4304BF6BD16C639D26D7DD93DCBBB32E408A62763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659560361, "uuid": "1202797e-f08b-49cf-b9f4-52a7348620d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659560361, "uuid": "26941267-ff65-477b-b9ac-c472fd4a972f", "value": "12288:luJpzzHu0uO7uWiLE4E/F26Is0N+dvWKKtGcu3s3ZVM:sLuqDAOc+dOKKwjs3HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659560361, "uuid": "ee1b0487-f2e0-42b4-8238-09685ff2f4ea", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659560361, "uuid": "98751264-e4fe-4913-b9b6-d489a339b8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659560361, "uuid": "09c46daf-37bd-40ae-b5ff-014020a5b88e", "value": "EXCINV_EXP12_SB Intruc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f266c659-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659513030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513030, "uuid": "0877f4dd-ab32-481c-a4e7-a980038ead2e", "comment": "Malware payload (DBatLoader)", "value": "af30b124bc87c14dd6725b536f42296a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513030, "uuid": "8e8b65cf-3278-4bb3-a4f9-84fa5f4b5e1b", "comment": "Malware payload (DBatLoader)", "value": "4e28ee862341cc547ed747d3b33502f28c7fc6f59a076519345e419807d733a8", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513030, "uuid": "8791884d-5147-4eb4-a107-17386d389895", "comment": "Malware payload (DBatLoader)", "value": "4f0e473ad0a4041555cb2a261bc6da0788d1887e", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513030, "uuid": "584323ee-614e-4566-b2f8-b11409c06b25", "comment": "Malware payload (DBatLoader)", "value": "e75aa2902679d121dd0a680a7deb41bf72d8de93f157d8f4ff59b7af056e991f505539af791b47b4001d28d3a0df9994", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513030, "uuid": "05bf74cf-bb2b-4825-be15-820ad4bf0769", "value": "T1E6B423A4358B1E7ED02DC8ABFB77CB78838F24D9552A435C69192AD7197FCB12727010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513030, "uuid": "c6e75b92-cfc1-4ef2-8b8e-5055ae54163e", "value": "12288:WEscLJRYjCdckUwscY+gh4dweNRo8o9ccaR3PFF0EQo32DhTHqeB6:MRCdc7cYFhgCefFxehT9B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513030, "uuid": "0314ad89-9e47-48f1-aaab-642825e86dff", "value": 530823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513030, "uuid": "37aa8d76-7f72-4b31-a0d6-277c0f0ad5c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513030, "uuid": "f85d44e7-95b9-4f57-a0eb-680f48c114dc", "value": "Potvrda narudzbe. RS0324452672.DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54253a43-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1659557432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557432, "uuid": "e200f28b-2ae0-4c28-9796-bdfbaff261b3", "comment": "Malware payload (NanoCore)", "value": "6bf62e5fffe8f3960fd00ea32468fe2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557432, "uuid": "b46c82bb-7168-44a3-be42-67d07bb0e2df", "comment": "Malware payload (NanoCore)", "value": "4e8ac31a9398a014baf30bab2e812e388a57fb30d65f72fccb3b2d1663d2010b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557432, "uuid": "1bcc4a33-66d9-47e9-81e4-f8a26ba14ce2", "comment": "Malware payload (NanoCore)", "value": "0d73585ba78da62ba93155d3762dc0ce63490dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557432, "uuid": "03dd952c-080e-4885-b4f3-cba985845b2d", "comment": "Malware payload (NanoCore)", "value": "a7d4f204f828c9a837f25248173bcb171776f4d561182c27c82b0016050a64c70fe4bb994f0376ab78759da238e1f8c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557432, "uuid": "9fbdb8d6-002e-4dfb-8288-160a6b76ad94", "value": "T10005E094A35BAD33F07925B7B44050482B71546D81E1E2A1AEDCF8FE70A6B830DF1B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557432, "uuid": "c1344e3c-2f04-4ea1-abb9-c5365b544b9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557432, "uuid": "1bb0805e-d67d-4389-b98a-4108ba44976d", "value": "24576:xNjLlpxr1LGYNHwccx49wvzBC2nk/hq07t1jF:1rl7NHjh9wrwnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557432, "uuid": "cf5c7c82-456f-4f1c-8fd6-985ad094e797", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557432, "uuid": "93ff7b76-a32b-4583-b2f1-6cd9be1f6b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557432, "uuid": "48caf799-b3c7-4ca8-9f8c-484706ba1a2f", "value": "6bf62e5fffe8f3960fd00ea32468fe2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5ec730-1324-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659528245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528245, "uuid": "ce5277d9-fb63-49b3-9212-8045a71b3196", "comment": "Malware payload (Mirai)", "value": "d51417cf3332dd54bd1654c361831d04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528245, "uuid": "258117a9-4c54-4a68-872d-a3e8f6419116", "comment": "Malware payload (Mirai)", "value": "4ea8eb5f5e5e23720fd7d579394a0007e72380383464648fd7be8fd5c3901200", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528245, "uuid": "81a8929d-5c86-4cb6-b8ba-a60ac6405c50", "comment": "Malware payload (Mirai)", "value": "64592536597c2b242bff88039cfd4d1352850c8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528245, "uuid": "4f048f28-eedb-41b0-901e-4828ae26fe47", "comment": "Malware payload (Mirai)", "value": "0b600b00d0a1cb59146fe675592f687b3b7fafe32083c591edac5abd5e8b43784d39970cfae5ad719d76f01cbc4a963c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528245, "uuid": "73ad2d79-6138-4be4-b254-1d9c3125b29f", "value": "T123F2E11F88F11D64C57F813925CF3A4B06B6C6478D8AC1FB7AB134A21D87FA96B244C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528245, "uuid": "7501717c-b271-4b81-9761-cc20c0d481f8", "value": "768:rWCbr24OJwi4fkd4ziHfKQZUoNcRUsM1gMXx+VgnoTlfcfIko54nYnbcuyD7UGQL:r324EoffzI6CbqytkkIh4Ynouy8Gyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659528245, "uuid": "22cf0550-adc4-443e-8b92-6df94effd2f3", "value": 37460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659528245, "uuid": "eba02c6c-944c-4aea-9b43-a34901a7ff6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528245, "uuid": "75bebc60-8521-4590-ac35-48bb8d677163", "value": "d51417cf3332dd54bd1654c361831d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc2cb86-1312-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659520750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520750, "uuid": "97f36aa2-64cb-4f72-b987-7209110571ed", "comment": "Malware payload (RedLineStealer)", "value": "fd0813b4ab3e5e4481f21ca11b722be5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520750, "uuid": "db017bef-45f7-42cd-81ff-be35cf46afce", "comment": "Malware payload (RedLineStealer)", "value": "4eea620a4808a85120a64ef027239738d81a960961c8d21071f8680f7b7379e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520750, "uuid": "8812c57c-3ab3-4b51-ac37-b6d9831780d8", "comment": "Malware payload (RedLineStealer)", "value": "fe0935428b0fe0ae79784259e5214abfbda29c25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520750, "uuid": "edef0c8d-f046-4632-b40d-70f531c69c20", "comment": "Malware payload (RedLineStealer)", "value": "85d32e8c3d2b6be9c909d754b0d76fcc65387bbfbd53cea0cce5e4520f528e708cffae6dfb5e047c73c5193c6d141e07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520750, "uuid": "4445aa5e-3808-4c87-a73f-5da8559a0f7d", "value": "T11A94229D746868DEC22BE1319A9D4E848761327B938BE353F23B70607B4D3139F250E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520750, "uuid": "8c65b348-4961-4fc3-b58a-abbfa0956c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520750, "uuid": "425ae667-a756-472a-97ff-a8d80fa76fb8", "value": "6144:jIEt8rVnQkw+TSGD4H45Y4WoWgUAKw+d59eRsItTQa7GiNpGCMG:jIi4agSY4H4GAUAKw+vyXtTQbi/GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659520750, "uuid": "0f794e47-9b71-4e06-ac01-d433a1a2826b", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659520750, "uuid": "c237c4f0-987c-4fa5-a27e-83873486bee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520750, "uuid": "e7d46fa5-b97d-470f-a9d6-5db8245d58d1", "value": "fd0813b4ab3e5e4481f21ca11b722be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae5105-12f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659506221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506221, "uuid": "855308af-45f4-4424-8c93-259a291d9675", "comment": "Malware payload (Mirai)", "value": "2949b42edf98a84183652c4fb4c7f2b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506221, "uuid": "b929070c-dfae-4609-98cc-96c623855d48", "comment": "Malware payload (Mirai)", "value": "4f325be9d7ea9160d4e698a4d736bdbc385f01508ac617223a91e86453799db1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506221, "uuid": "a8b7260e-49ca-4d4f-b4ee-11d854e634a3", "comment": "Malware payload (Mirai)", "value": "9f800180b8d829897f518739d5286def0983bdd6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506221, "uuid": "e6593a45-6467-4f65-8c22-e89b86558f74", "comment": "Malware payload (Mirai)", "value": "589c8f155a0dc4d87d327c568cab609edf87d0ede01d19e62ec9b026f089b2b6c7d8aaea88e1339455844dd5af317b7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506221, "uuid": "3c6e6220-a93c-41f0-a345-7e21f9f50ca7", "value": "T16403F11B43A7D2FADC3B4C36909A0ED0F580FD6B244BA6EF259D124E5DFE1805D20A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506221, "uuid": "a44998cc-cf4c-42ec-8692-1a4face7ec60", "value": "768:Xph/+iybUQSvcCu7e7BreFe7zUm/yLTsq1uzMl8Qkg2feMUox0wGFydx0oi:Xph/HhvHcyzH/5xMeQkg2f8q0qpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506221, "uuid": "ac0d186a-8405-4dc5-8d72-1af490b48ce7", "value": 37760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506221, "uuid": "2fe22b47-cb38-46af-91d9-9c9576730607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506221, "uuid": "38015fb5-c2a5-4524-84b1-0d556be194ec", "value": "home.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483045df-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511886, "uuid": "64377c81-6f18-4286-9f6c-02b28328f4d1", "comment": "Malware payload", "value": "797c11df23ab1ee9b72cc85803e0aa90", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511886, "uuid": "ddf914fe-1223-4830-8055-beaa95cb7a5f", "comment": "Malware payload", "value": "50276571b60c05a68976baa27cf72ee5e5099e4528104281b7fbc8626ece0360", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511886, "uuid": "bc88a398-79db-4559-9dcc-2fa093ae422c", "comment": "Malware payload", "value": "41ec187cd17ee0f34ec0356b8419575eaa38bbd8", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511886, "uuid": "37ea4887-7700-424a-8ecf-9bfa1c2140cb", "comment": "Malware payload", "value": "4e2ddbbfd5d767fbfb31c802dcf8e0e1aba03b5e202b35d29c2e4831b50631f73569d9b00df1a80bbc45e6dc933bca03", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511886, "uuid": "5850160c-0b51-4403-a5a2-230f4d45bbc6", "value": "T10A8402CC33C1CAF1C067C37A2153EA845730B922A26711AD6AB454EC1FA77854DDE7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511886, "uuid": "eb266821-0a46-4a02-8fa3-95478b40b257", "value": "e07d5b7cbc0bb851691e27f13758b2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511886, "uuid": "f1a04a7c-8520-4903-bc2b-631619a2b9f7", "value": "6144:4TctPCo9M6iCYuaz67h/kI1Zgx0bgUzq/K41ac7uukkoILHQ8bnPyjDeuFXs:PJVN1xFJZgCqBau/hr6jio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511886, "uuid": "f56398a8-7e48-4932-845e-d8ab3a90e0d5", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511886, "uuid": "aef39268-f59c-474b-ba3a-8cd63e56598a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511886, "uuid": "8ebab07b-20d4-4a8b-a88f-eadb6e08bbd7", "value": "OneDriveUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64d4282-137a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659565355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565355, "uuid": "ee910acf-5c41-442e-9735-0490e1da1958", "comment": "Malware payload", "value": "869b5d55618b2975af5859691e8b0d2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565355, "uuid": "040eb744-5f07-42f6-81e3-649df10f7744", "comment": "Malware payload", "value": "505a456c707a01231e43505cf4a1e16705052cc27b60e891f4cec89ec05c6a0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565355, "uuid": "c7fe3365-9033-4bfb-9d83-4084e47e97d8", "comment": "Malware payload", "value": "0a4ab41ec770e70a2df29c3e9c0e558af80fe610", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565355, "uuid": "7c5348dd-2ef1-433a-98bb-639228094456", "comment": "Malware payload", "value": "93947924832914ffdbab3ddc4b547c83104f88f2ae6d0243732ad3220b36c2eb964ca8b3292d69bf8b548c9c634544d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565355, "uuid": "627a8fbe-00ab-4818-9250-fecc176619fa", "value": "T1C38295B5B3D7CA79CDD50B318412D1450734BE6AD853D62BF1C93B4F1DEA1880257AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565355, "uuid": "c288f93d-77d0-4461-94af-8d8eae6804ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565355, "uuid": "829dccc3-78aa-42ad-8393-2eba73603663", "value": "96:YPA8H2/CtNxM4VVpacm7VbHhXr1TR6glUkFiIfnkMNM4rAX0SV6orKAXTjAFbAhv:Y4QLxDpiZbHhFR6cBAIfntFsOof4bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565355, "uuid": "54bd7771-3ff3-4b74-b51d-6531c8be353b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565355, "uuid": "1dbb5adb-c038-48b2-b4db-b3e7deba728c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565355, "uuid": "d2f5b87f-18cb-46a2-869d-37d06315fdeb", "value": "EU-Business-Register_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4362f2-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659513936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513936, "uuid": "81117b2b-9c3b-49ed-91ff-b89bc8318994", "comment": "Malware payload (Stop)", "value": "523c2052b6edc72e9233ae590acd57e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513936, "uuid": "e4e81b89-aec4-48ed-b724-fa5333df0d0c", "comment": "Malware payload (Stop)", "value": "50b8cd897266758e38f8c6419df0ea95484f26745e07ee45268455cd41c15a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513936, "uuid": "4c407491-562a-44fa-a878-5c5899dc8196", "comment": "Malware payload (Stop)", "value": "6325a860be5ac5f8bdd28be3388736a7a14c0b6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513936, "uuid": "252238c0-729b-4205-934f-20844f8048c7", "comment": "Malware payload (Stop)", "value": "05811dbc13695cf9d0006325abff92183785cf6fbe95709c992d67bf6db01f865a8829ae0edb6424d204c8b7df81a9b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513936, "uuid": "8c284ebc-b4cf-471b-ab13-0a0865e6b540", "value": "T1A7E4123279A0C032D5B3AA70687196B5AF7E79636638A9CB3390163E1F702D05F6471B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513936, "uuid": "35b69594-58e1-47ab-a7fc-e0c2de6a74c6", "value": "7b8da7d62de49809359b378ca66a56f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513936, "uuid": "551583ad-3338-4101-b1ca-36d855879e1c", "value": "12288:tJ9Xaitp7EotQRQYJ2ENRAlDECxFUMCdSbm16HsGJ7e0mpLe8fqbHEdPeJpoA1rQ:t3X1pYotIQTEODFUMlb4SbkSuqDEGpHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513936, "uuid": "ce6fc8d8-8c0d-4d29-9c1c-c89e89226cd6", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513936, "uuid": "594ebc67-7166-4fab-866d-131eb710816d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513936, "uuid": "d194f428-d229-430e-9849-d5508cb9adc0", "value": "523c2052b6edc72e9233ae590acd57e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3e5dcf-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522548, "uuid": "7c5163d0-f349-47df-ba6c-565665826a1e", "comment": "Malware payload", "value": "cf3f716b2cb3a0e3b4201437f9b1f36a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522548, "uuid": "e4bac9e4-8c88-40de-aff2-592743dfb130", "comment": "Malware payload", "value": "517b37b47dc15abc5ae733109d178dde2e34a6f0cc3d9f93b1869c3c576b3d76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522548, "uuid": "c0d9b35d-9374-4def-a5ae-99c2978c32c4", "comment": "Malware payload", "value": "da2682a28d08ce47ed5bef87bf946d411350b00b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522548, "uuid": "c2e72d57-b21b-410f-871d-824e48f3caff", "comment": "Malware payload", "value": "dee8944808f3d103cf2061486cb98d5255eee8b73c3c5172261238ad924197253ce855ee1533d837b048c8c7f3379260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522548, "uuid": "edceb7d5-ce5c-40a9-82fd-0133d7317344", "value": "T119F5CFFD6148335CC02E88309123AD08B1B2551E0FBA8AFB75D7BED06B9F5D19936B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522548, "uuid": "48ec5f27-8ce2-4976-8a5e-61e64e87262f", "value": "1f7755bcb3ee8688b73f1a5ea3e603c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522548, "uuid": "86f38d34-e2ef-4f23-8b34-854185a98fdf", "value": "49152:xYx3EAzzwMLTx6mrGue8THkbI12qDLdtkPq+3/QvZ7U6Xk9xnGyJNLDOTy4xEUlU:izxTB6utOGISRURg6Lm2JMwujBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522548, "uuid": "96e76a49-1b73-41e4-8ee1-c2d19ba36c61", "value": 3554448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522548, "uuid": "19d4dfab-1caf-429c-b162-c54580c08a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522548, "uuid": "cd33ba40-b78a-4760-b73f-47c3404acd85", "value": "517b37b47dc15abc5ae733109d178dde2e34a6f0cc3d9f93b1869c3c576b3d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f091f7b1-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537938, "uuid": "54a4036c-ad34-4c15-a2a4-33cd68d6e707", "comment": "Malware payload (SnakeKeylogger)", "value": "4503cc8f6ec76d080c93b3213ee04f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537938, "uuid": "ad1dd06d-2394-45c2-9587-7f8672b340b5", "comment": "Malware payload (SnakeKeylogger)", "value": "52ea9c74febe9144a15c945f7b829e29c9295a353d69fc46ef9b0467944bec46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537938, "uuid": "98fc8e79-b176-400e-b7e4-cf70d5d7c5e1", "comment": "Malware payload (SnakeKeylogger)", "value": "5bf9051d806a6de245cde8097f499d290886052d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537938, "uuid": "4ceeb4ba-5b08-4368-bf49-768e5fb9d398", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebeb750499ddb6c5e5d04b3f2d20ad3991b8964766d00721f006df37b51890021c7751e671a3626d2bb8586b96aab3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537938, "uuid": "81c73a83-a5da-48c8-bd28-1c694450c6ce", "value": "T1F9F4E01177A98B16E47A4FF2B5A080144FB3B66A7063E35D4CC938E75E727434A1BB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537938, "uuid": "bf931cbb-6821-442d-ac54-dc14a6efc0d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537938, "uuid": "9ae3e278-e651-40e6-9100-cf15ddd38d8b", "value": "12288:6fFlg6SKlpxgst6bjZ6nCaxxTd3z2Ljpeuz:+DLlpxxt6bgZfTdj6d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537938, "uuid": "24f04660-7754-454a-a435-fcf9787f7fcb", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537938, "uuid": "e34aa07c-7dfb-426a-aab2-dd7461d7a943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537938, "uuid": "a1648bab-7a03-451f-a2c3-e3e2b88e832a", "value": "quotation+5543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af16eff3-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659534392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534392, "uuid": "b7283f75-4a90-45dc-ae3d-ed98ae1dd0d3", "comment": "Malware payload (Gozi)", "value": "04ead173ffdf29ace7c7e338d917021f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534392, "uuid": "85ad8c0d-1548-449c-b6b4-6b0447837d19", "comment": "Malware payload (Gozi)", "value": "5409ba01037c586c729d8bda05492461ce1c88e565a13c181b7f5cb49bb5902e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534392, "uuid": "0df048f2-11a6-4349-8f81-1b426915421c", "comment": "Malware payload (Gozi)", "value": "aa1e2cf23558741994d101333d8030b05f663a1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534392, "uuid": "e2913710-f8b4-4bb7-8036-5c0bbc4f50b9", "comment": "Malware payload (Gozi)", "value": "7845627e9aed9db26fbf1b37691d38d4904ef2f7e162a25170ef59780b41646d545b43e82ba5a26c554062df3693c6cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534392, "uuid": "d5635a93-c436-4a22-bd8e-fb920cfc92d7", "value": "T168B4B051F39404A7EDAB8539C9939717FBF2F80113A4C75753A08F9A6F13B62E628342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534392, "uuid": "d85b2b7c-efff-4be3-ad9a-217627323665", "value": "a19b7b6d46e85017f69dd15b342eb166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534392, "uuid": "68b4a747-06c6-4e50-ad32-5313f1a0fecc", "value": "12288:YFXq3xMvvrRs73Mc144gwTAYpBJ7PgyciQh+02mELRvbMZBsP:YZ4xMvjC3Mc144gwTzTrcbhLILRvbYsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534392, "uuid": "972c6389-52ad-4717-a2d2-303021e27c97", "value": 521128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534392, "uuid": "ac3b932f-8690-4706-8f4b-44b1fc2251e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534392, "uuid": "725db012-de9d-4450-a086-b83db5dbd3f4", "value": "628bc58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6cc00c-1329-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659530338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530338, "uuid": "e72d84d4-707c-4142-9647-eb1f38b727ef", "comment": "Malware payload (RemcosRAT)", "value": "a35383f9431d405cd1164a1ba5c93a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530338, "uuid": "99990c55-a811-4e67-bc50-7dca6fc16d83", "comment": "Malware payload (RemcosRAT)", "value": "548a6de77d41a75d8463e4aa3d596caf294b6d5bfbc486dfaccd95b1819a1016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530338, "uuid": "c44ed2a5-6961-4a1c-ab77-49589c1ee3c1", "comment": "Malware payload (RemcosRAT)", "value": "dc09e242d4a334a70717421a767e2fd76e9f5dec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530338, "uuid": "dfdd9766-7c80-4675-88d3-9d88ecf0a110", "comment": "Malware payload (RemcosRAT)", "value": "0fd1b5613e91115f9ce75685bc5c74402f0a63f6020ca6ca98d4f9f2d2d2703a1a1ad56a11247e399a09e4fa6c0b29c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530338, "uuid": "276a62eb-4074-4cdc-8504-04baf7caa584", "value": "T10EA49E12B4D1C032C17222700D69FB759ABCBE20293549BB73D92D5BFE701D1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530338, "uuid": "af1f9085-e5a2-46cd-a5ee-b1a15240d9b7", "value": "409f5d6d64eccf1b9873a7c796c3f1ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530338, "uuid": "c692fc98-20a8-4496-8ff7-ffebf42b0d9d", "value": "6144:Mc53ezqVrhiBZ84M/k22nZcrTEfCNV0cjd2shWR5dhTAOZZ8jXCSrcD9u:353ez1HzMc2k0EKNV5dlE//Z8eSuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659530338, "uuid": "1e21d71f-86b6-414c-8919-8b662ef3a709", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659530338, "uuid": "590c8c27-0deb-4e24-a61f-b1f93dd4a908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530338, "uuid": "b08b27aa-a1e5-4b57-b648-539baca934f0", "value": "a35383f9431d405cd1164a1ba5c93a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43f8bde-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542642, "uuid": "6a692a4a-0762-41b5-84af-46cfe5623ecb", "comment": "Malware payload (Mirai)", "value": "652e7ae65985317c2fc38d6db8be074f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542642, "uuid": "1d6eb7fb-cea8-4857-ae58-3777e8e72965", "comment": "Malware payload (Mirai)", "value": "54cd43e0ca9d2c8c743e70e0802f112e06301385a441f86cf5e68d6b545fe932", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542642, "uuid": "da15d84d-c4ae-47bb-8d3c-eca0151a5b55", "comment": "Malware payload (Mirai)", "value": "8f042d5e06fa28d0ee146bbda3eb73dde0888493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542642, "uuid": "9dfbe18a-15d5-42e5-b7e2-c7e714c8fbb8", "comment": "Malware payload (Mirai)", "value": "2828d26d521ce769a23953ebc19e5ad794e38213c3bdca28c3a2a45b1b046f47424563d4f0019770282fbd571d083dbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542642, "uuid": "89e20997-1b68-42c3-b762-13af8efc4b2a", "value": "T178B2D1CD61943184C98D7C7C178D4A664F6CA1D0BADD8B16E364CD98B3BEA8F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542642, "uuid": "c742cc80-6d66-4842-916c-153493499a8a", "value": "768:otrQlS07dEv0UXqUhvQE+CXQKMQKCXBpH5ZqqWv+:iQlS07FUXqIYSXQKquHvqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542642, "uuid": "bedac9bb-da66-4faa-a9c0-103f074c66b6", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542642, "uuid": "63b49eab-8fb3-4232-8267-5bd0711ab0be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542642, "uuid": "0eefcf3f-df85-45f3-b5a8-e042c27cf347", "value": "652e7ae65985317c2fc38d6db8be074f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa3c574-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659534393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534393, "uuid": "5a1a772a-4647-488a-8e10-c96a32534b4b", "comment": "Malware payload (Gozi)", "value": "dc0242b15c433ce34164bc39bac1534f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534393, "uuid": "cd56e673-889b-4778-9cc2-a89ed96e9f6d", "comment": "Malware payload (Gozi)", "value": "54eed1d4eb8679e67541c1102e743a1d636b90860bdea3ace0e9fd7a2d4309ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534393, "uuid": "ae652aa3-1835-4778-921c-df2f61d02440", "comment": "Malware payload (Gozi)", "value": "26e1f261c95841e4a4ba71fb909f567fabd86ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534393, "uuid": "3026962e-30b8-4fb2-81a3-0b2baf0e3dd2", "comment": "Malware payload (Gozi)", "value": "7639f05c93db52531dbd532162e459554091b079a5e8b46afd2bc6996d0f90c6f22a29217a6807a43d4570d02afa85fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534393, "uuid": "eeab8c39-48b3-4987-9e97-6ec5e55eaad7", "value": "T113345C5AA3E51995ED6BC6B6CD53D227EBF234092B14D30F5370CAA66F17722B11C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534393, "uuid": "6df5300e-2a5e-4413-8479-4588d45acb04", "value": "3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjQ25e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534393, "uuid": "290c2964-64a3-4d98-921a-45e053d74d57", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534393, "uuid": "f9c1495f-585d-40ab-ba47-6f3feeca3ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534393, "uuid": "43a339d1-9fa7-4585-b77e-a99fc99bbecf", "value": "c6a0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4a1130-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537954, "uuid": "c9023ff9-eb5e-4fac-9d84-41f9e8f00db1", "comment": "Malware payload (SnakeKeylogger)", "value": "60c7cfe1276ca208f522afc5d92fe2dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537954, "uuid": "36538f8a-4dec-44ed-8e8c-634c0651cee1", "comment": "Malware payload (SnakeKeylogger)", "value": "5506ef7fede261429a64c9f9b799eb809c0ccb64923a67e59a01c968efedb239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537954, "uuid": "c6f1b899-f65f-438d-8a16-52299eb06446", "comment": "Malware payload (SnakeKeylogger)", "value": "e9ca0a0e8605c400189ffee6ada2ece39d52a494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537954, "uuid": "50665ac9-bfad-4013-9398-f9122a93f70b", "comment": "Malware payload (SnakeKeylogger)", "value": "71d9ee7446b36f3dc255cf3a09c805ebbc949fd070b04fefdde9afd81670bd5233af6206f22fa89df3951d8be2352cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537954, "uuid": "ca45aebb-21b6-463a-8dfc-98d688f37815", "value": "T179E4E0057626DE13C27C1673D1D222688FB09647D2A6D74B7AC817E50E033AAED8F25F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537954, "uuid": "28437cce-647c-4991-bc61-dc8b362c1f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537954, "uuid": "8092787c-3e30-436c-9b01-12ce9a91aa3b", "value": "12288:jwnwpFzmJ3T1TIFdlfkx8+FuBbUbtpzsJy2bkjbwcr/KnK8/fIcDEdOT9:9mxT+FdNkx1UFUBpzKy2IHwl3/fnEAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537954, "uuid": "38879c10-617b-4f04-b865-4853abec73cf", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537954, "uuid": "65d38a90-1543-4b36-b781-61b4c98f12c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537954, "uuid": "b07f2b86-9055-4aad-9e6d-073ddec22bf7", "value": "60c7cfe1276ca208f522afc5d92fe2dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1c71bc-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511864, "uuid": "81eba2c2-b247-4c86-b51e-e3f76880310c", "comment": "Malware payload", "value": "0b986c7596b358edcb60f5f723b0f25d", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511864, "uuid": "a5c4f466-9737-4d9b-9197-bf5ba4cbe7a6", "comment": "Malware payload", "value": "55278398e7766071d38e369cf35af57e0f29ce3b0d02ebdf06b79b6636de8f5f", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511864, "uuid": "97840a39-a20e-4976-8376-451525ad8adf", "comment": "Malware payload", "value": "52aca248ae9548643938328d944d8699abd9579f", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511864, "uuid": "bc913918-652f-4be8-b706-b11dc818a63b", "comment": "Malware payload", "value": "cd60273bc653b1f46ccd2be5092b4517518474a85ddd45f727ef40119a39ed850bd6f1efe02ba33013ddb96f37d09917", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511864, "uuid": "f30c2582-3ec3-4a4d-8835-d4278e5f2d8d", "value": "T1322139F9C479FE8003BD76E04A723EE710959167877C8629FA8108E2B92A515EB3568C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511864, "uuid": "3972e91b-e1b0-4801-ae5a-d85716a416a0", "value": "24:TSmM1rfWHgiQ0ySmSX1XqaMQblKZZhKGI5XqaMQblKZnIznUKJe2si0O9CT:Wpr7SmSXFb8HIpbcIYWBsi0K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511864, "uuid": "98fd70e2-e505-4517-9b47-8d400fbc9ef4", "value": 1380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511864, "uuid": "681a7439-82aa-4b6d-ad06-2172eb04098c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511864, "uuid": "833265e1-a536-4ba3-acaa-a68174548ea9", "value": "power.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4214eaef-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507580, "uuid": "8f467c4c-f035-4c09-bcf2-a54b4fabcab9", "comment": "Malware payload", "value": "e1184999b58f7c6210649e9ddc66888e", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507580, "uuid": "0d0caa93-acde-4b30-8c3f-9a6aa1d43625", "comment": "Malware payload", "value": "5850d3b23060abb351ae9dafecfe7c19c9e890004f4c14f8ee7d164838fc356b", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507580, "uuid": "f0b65e3b-4709-4865-8198-17e5a792d78c", "comment": "Malware payload", "value": "57acc489646dc12d39c2040c9b020c566b6b23a4", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507580, "uuid": "a09c718f-ab89-43df-8547-1ded1c8b8d7c", "comment": "Malware payload", "value": "0b7bed496e17196acd7d4a28da609c2aff18bdbb551996ada57b2bc36828c0e860909354e6b286b66691af4597e1b50c", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507580, "uuid": "00e70543-fb29-49cc-8eca-798e224d3bbe", "value": "T10615191BE76344EDC67AC170866B8372BB70F86416316A3E2F55CB351F21E605A2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507580, "uuid": "56013628-a318-4f65-baa8-5548de625129", "value": "0f6777bf8d57b5feb74373fd100eae71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507580, "uuid": "39e88bee-a6e9-4698-8fde-f2adcec2c795", "value": "12288:jI1WH6uBHz1Wyw+n8ygENbJmEL3Bf+fp:sA6uBHJWYbgENb6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507580, "uuid": "ad8dcfd0-9d3a-4eac-ba89-0b9e320f5139", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507580, "uuid": "0e50e7cc-21c1-4b59-b3a5-f4ca15505f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507580, "uuid": "a60e51db-0594-4bbf-b00d-d1ca0760ca54", "value": "hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c0b13b-12f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659509548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659509548, "uuid": "4efe5826-bcd6-4505-aa90-3ecbe9775d44", "comment": "Malware payload", "value": "e17aa44b4f566da207cf674f527ffdab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659509548, "uuid": "d3749997-6249-48fa-bff7-aa422e28c912", "comment": "Malware payload", "value": "58de8b633d82dca0a980a2a1b271499b9e3c88fd7ffd02a8a3b6689bbb2f8172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659509548, "uuid": "8f331bb1-b9f7-4fab-ba9d-b5ad212cdc6f", "comment": "Malware payload", "value": "1ef37977973b8bcea57dfe53dcf07cc54208a762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659509548, "uuid": "b2a13665-1500-4c4d-a8ba-a4a6eb65a9a2", "comment": "Malware payload", "value": "7cd3d8f0a78f11ee8c96a4a74c03654a1ef05e91c6de62cd7f792477dd8cf0c98ef32b28f4c14b58251dca4ce678a545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659509548, "uuid": "13ae3c06-d3e7-44ec-8560-aea72e7597be", "value": "T1981733BD2288376CD00AC475D523AE59E3F6951D1BE5D6BBB6EB73803B6B831D402B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659509548, "uuid": "1f0e5c42-8196-4b9c-9a89-6a6646708e42", "value": "ff344b728be073f85b46a7d770df13cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659509548, "uuid": "d55dd90c-818c-4922-859e-01d9515fd8ca", "value": "393216:sH2236uhe5HDyLbhPv9/hCl0aMuu8rUk43uCu2B15Y0oUmNITFeP0b:sZ6oMQbhP1/MeaMuFrU+CBf5Y0ojNIYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659509548, "uuid": "f5655a93-6efe-447c-a1b3-12050da4270a", "value": 19976192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659509548, "uuid": "b2de656d-c0e3-4eca-9d42-0c6c45340386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659509548, "uuid": "defab5f0-fb13-4c8b-bade-6ef74c142b17", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec7f27b-1347-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659543411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543411, "uuid": "6e27ed29-a3ea-4bbc-8a79-a095f76e08fd", "comment": "Malware payload (Loki)", "value": "cc76ce2b86f70e72509e0b1400f9654b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543411, "uuid": "2a640be4-23a4-40cf-899b-960b3daeafbb", "comment": "Malware payload (Loki)", "value": "58eacc46d0b0cea33f72048362effd466fddda3a98e5b190102e0f74abb4356d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543411, "uuid": "9cb1e78b-bb1c-4cbd-b970-a78c7b00c504", "comment": "Malware payload (Loki)", "value": "08ee70586a0939201f517d5673d71e642e007ddb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543411, "uuid": "08ebee36-31c6-499e-8e84-607df53b3879", "comment": "Malware payload (Loki)", "value": "fc6c3aa183f7606095d1c86b019620b9586bdfbf50e56b32be4dee19b8103d6be4fecf1099bba296b63b6867eaef815c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543411, "uuid": "e3aabc42-03e8-4136-a174-1151187a03a6", "value": "T17204BE2133E0C072D0AB257058758EA16AFFB9626B749A8B37A4173E1E757C05E3835F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543411, "uuid": "09dc0d2a-df03-4027-b222-d8c8b22a0862", "value": "16efb6b0368de80f5b2f8ee7ed5ecc80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543411, "uuid": "fc2f08a7-ec7b-405b-8c45-8b1d5c2b2013", "value": "3072:DSeSiKLe88eqyEGf6mMsaSXHidruJ7V1knxwK9b44rxsY:DXKLeBe4mllX0C31kF9l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659543411, "uuid": "61d8b4b1-b916-49ad-a813-f804c2e1cddb", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659543411, "uuid": "33c460c9-7094-4999-aad0-28e5a018fcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543411, "uuid": "5560b496-a646-4717-adfd-e216b4ec4331", "value": "cc76ce2b86f70e72509e0b1400f9654b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081ecbfb-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659513926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513926, "uuid": "69e16db9-b97e-4c74-a746-081ce4535695", "comment": "Malware payload (ArkeiStealer)", "value": "72ca6d6179572214160da9198d4dd496", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513926, "uuid": "3d63e556-1719-4eb6-a4da-abd37cad0a96", "comment": "Malware payload (ArkeiStealer)", "value": "5a3d6d5164f3d0a89f158b542c683752ba6071799d1b375d0b74a643c2cf7618", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513926, "uuid": "5bef7079-1f3e-48d9-a04a-40335de917d7", "comment": "Malware payload (ArkeiStealer)", "value": "fbcd2b16d346c156f6083b0367b751df0a8d6503", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513926, "uuid": "dba2251f-c5b7-47b4-abcf-f6fda7ee0045", "comment": "Malware payload (ArkeiStealer)", "value": "f9e4609698fdcee2eadde88226251fb33e31f36f5977914d98b5e4c21dfc75e8e88c8030f00fed661891930db8e99a42", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513926, "uuid": "b61fbd0f-f69e-46b2-b64e-06ddffee2398", "value": "T14A04BE2133E1C072E5F75A705B7897F06A7FB932677886CB7764023E1E612C16A38356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513926, "uuid": "3f888501-f323-438b-94c9-17011a0ccd61", "value": "7b8da7d62de49809359b378ca66a56f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513926, "uuid": "2e648e08-e8f0-4153-8a78-d63b69e3953f", "value": "3072:2YCYERsUNdM7FUSkqwICGcieDdIkQ0fE5BrvJPFya/bd/wyCGxqWoVim4eY:2YNlUA7mSkFKe5IJ0furjya/bZhqLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513926, "uuid": "ba27b2f7-915b-46f5-91db-595434c31c3d", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513926, "uuid": "99f3a017-c35f-4745-8f03-c162cd0a0fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513926, "uuid": "68e3077d-27c3-4e23-975f-2531e5528a54", "value": "72ca6d6179572214160da9198d4dd496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30109ae3-1386-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659570257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570257, "uuid": "a80cd5d1-e88f-40eb-8de8-8963c483ecb6", "comment": "Malware payload", "value": "91c1e8f4da22bda4a24dd23066e0d8b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570257, "uuid": "786ad9d4-cf3a-45c6-b25a-db314bf33fb4", "comment": "Malware payload", "value": "5ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570257, "uuid": "74f28131-600e-4122-82e0-e8c2b9d55c41", "comment": "Malware payload", "value": "6bfcb55cc76d8b06962dc47aec445499fcbc3621", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570257, "uuid": "9f1df0ca-6b0a-4032-8fc5-1eed520fceab", "comment": "Malware payload", "value": "1bc549c27195c080bc839f180fad571dc3f6cbc8a36d404a547ca8d8fd5f0c1338781b1750207bdf5c6add57a6aa8f8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570257, "uuid": "57b09386-8940-4b95-88d0-37d61d5b9a42", "value": "T143733A1A78D3C033E8450874C5D186C15FFF9D2376D6946FEFA9068E5AA02D806BABB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570257, "uuid": "22ed22cf-b44d-481a-91e9-00ad0f14927c", "value": "62309a495c8c304259f74d2c7a6b9f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570257, "uuid": "60c83029-f717-4381-ae70-8b6bb9c9b999", "value": "768:eAwNCKTBTxbgEq2RJH6Qe3qx5AUjp/bug/9ngYm7zxG7sRq7J/+qL/b+khmbJrwe:eHEmTbNBJHLcU1/bat3Rq/+c/hgK8t+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659570257, "uuid": "3183567c-1541-44c6-b2a2-2a85121952be", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659570257, "uuid": "324bdb3e-8b78-446e-ba7c-bb153d46e4c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570257, "uuid": "4f895039-d7fe-4c49-80ec-b2fd84ccb5ff", "value": "91c1e8f4da22bda4a24dd23066e0d8b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b465707-136b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659558625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558625, "uuid": "564b4922-2dd7-435f-9b42-cde6e8e6d4a1", "comment": "Malware payload", "value": "ef23b5c029fbf216a16cdd087f8c2969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558625, "uuid": "90d574b8-85eb-4769-99ec-35e50aadffc8", "comment": "Malware payload", "value": "5b57fffe97468ce49d2df7a1e0c15cedf34605f34ac5484dea0c2c3026eb249c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558625, "uuid": "0e4b7586-ca7d-45b5-90ec-88cbfc9df4dc", "comment": "Malware payload", "value": "45287ebc449efc4c1f7778231f00ea1e361c016e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558625, "uuid": "27ebf9b3-c4ae-44bf-9fdf-1687fdc130b4", "comment": "Malware payload", "value": "f1fa5f66f475614142cf6953f2e21e19e72edc2eb751dfe5a32b07396e4a424237f45cea974c06dae4e949c747ce35db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558625, "uuid": "c8df178b-6892-4f43-b5ca-7c472f4d56eb", "value": "T19CF49E1022E9AB18F03A977456E0D03047F6FD16D639D66D7DD83D8BBB32E418A62723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558625, "uuid": "10189a4d-e63b-4c7d-886c-91a55724f07d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558625, "uuid": "edbc97bc-d565-4c25-9c4c-0dd96f5eac3b", "value": "12288:ZuJpzzHoVduQ7uWia6lJ8IYKw06AJ4IrPCnhzugG07B:gLcfFb06A4IcNB7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659558625, "uuid": "e11e9a5d-eb73-4a7c-9134-1872d21eb317", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659558625, "uuid": "b139c59a-a4fd-4dcd-91c8-24d90ff290a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558625, "uuid": "4f4f1818-5a21-43d3-b3ae-18602ae07e08", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167136f3-135f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659553463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659553463, "uuid": "9693b922-7335-4287-a3a8-68462798f600", "comment": "Malware payload (Formbook)", "value": "5dbeb2492f8919efcc146e9cac71604d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659553463, "uuid": "5b137875-4b3a-4883-a326-b97f9ebeb75c", "comment": "Malware payload (Formbook)", "value": "5be7e2a77b35c4a4b902b3d391f6b06f53595e759d322638641977a4a45a4b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659553463, "uuid": "37752855-6987-4233-bbb8-6ef21349b881", "comment": "Malware payload (Formbook)", "value": "2ff498487ce1f08522d9ae4118032ede4c5b6005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659553463, "uuid": "1db48d1c-30bd-478f-82a4-015f4f1b1c99", "comment": "Malware payload (Formbook)", "value": "7ac52793078cdab1e4cd0b4ce2c4d498712f74a56b3667bbfc8f46a467adcf97545f8a7ba32d6f67c1dd3d04ff9cd523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659553463, "uuid": "acdc3aac-e8c9-49b7-b772-94ee15417fc2", "value": "T1CCF49D1022E4AB58E0799B7456E0D0304BF6FD12C639D66D7DD83D8BBB32E408A63767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659553463, "uuid": "47e5bf01-b587-462f-9aaa-ca004b6e489a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659553463, "uuid": "427681af-b1fd-4551-9cdd-f5821e1f6911", "value": "12288:OxzN1Hx3ul7uWibdsL7ehmADvOIvjKOuxTJiy9uVu/c0:G1gLL7ewAR7v4T0VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659553463, "uuid": "26728f0d-acb7-4248-95bc-d274db4413fc", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659553463, "uuid": "db2d4e22-dd0f-4e28-8af6-780138193c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659553463, "uuid": "649dcc3c-2d5c-4346-a939-ddbe0a89a446", "value": "SHIPPING INVOICE FREIGHT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f143ca3-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542740, "uuid": "ec8216f6-408f-4f17-ac63-3bdd75d0ea45", "comment": "Malware payload (Mirai)", "value": "9676355183c55e36bb21028d517989fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542740, "uuid": "7aa99c30-a741-4393-bd1f-2826956f5521", "comment": "Malware payload (Mirai)", "value": "5c0cb06ece548b477f24c3a21c1bf772ec442c166bb392d49de492c108301c70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542740, "uuid": "98d04eed-d637-46d2-b8bb-6e718138c54e", "comment": "Malware payload (Mirai)", "value": "09fde9164232d0604229604dc2cc68f953ff98e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542740, "uuid": "c3d3c34c-a45e-47ec-a338-a8b3e97ba018", "comment": "Malware payload (Mirai)", "value": "6ce0608c94b898013ef671ab400c4192ddbb04c4c70a9f330e9e6d5d7b2e7c1d03eb5e71f5907dfbbb08b6d89089da4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542740, "uuid": "59ce1eba-8bc7-402f-a874-fa29f7b478b1", "value": "T157C2D0A57864BDE2C9306C76D9688CC63B8625BC90FFBC7741110C28AED58CB4BF8187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542740, "uuid": "40849080-27f9-48e2-b480-45b3a023e6c0", "value": "768:JMKyhegCCMqfN11zqcEobtfUxYaOvUzT9q3UEL3g:OKy4qf7ISPa6LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542740, "uuid": "49bb562d-ef2a-48c6-86da-d710a29239f1", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542740, "uuid": "9446e30e-ab24-4c0c-90db-d0e270ad88e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542740, "uuid": "42e2cfa2-ec2c-470a-97cb-5f68c0c4fc9c", "value": "9676355183c55e36bb21028d517989fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6906f4ab-1329-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1659530409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530409, "uuid": "f95cb504-633c-4b62-a3bb-05954ab6accd", "comment": "Malware payload (AveMariaRAT)", "value": "24124eba208a4cbfb5fd03185c7b130d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530409, "uuid": "629f0edc-6e35-406e-ad54-9bd0431a427b", "comment": "Malware payload (AveMariaRAT)", "value": "5c42e1fd2ed113fb92328e888276f41c3fe43042486714d04fb8b440f5a43014", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530409, "uuid": "ed26dd81-d089-4fd4-955e-ebce964a984e", "comment": "Malware payload (AveMariaRAT)", "value": "2f722b6719b6774e18a77d59ffdc91b22dba6b81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530409, "uuid": "1b7f30ab-0deb-4699-b8e7-6016e058860c", "comment": "Malware payload (AveMariaRAT)", "value": "b9fb388ec7651a15fa6e536cfeb278508df8100871c8b65feaafdbc514a2fdc5ef990c76470bce0cc17d61b80b838df6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530409, "uuid": "5d50b745-d5c9-4e4a-92a4-9a712f337c62", "value": "T1A9B39E13F7E54835F3B201B01ABD7E7ACFEDF9700628849FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530409, "uuid": "a6b799fc-98e3-4a49-95ff-79783daa7cc2", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530409, "uuid": "4bde8789-62e6-4403-9c5e-dd073a7aec21", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659530409, "uuid": "88c556d8-bad5-4d65-85ab-34da4dab72ca", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659530409, "uuid": "9087a2b2-2a5b-4a9b-900d-51c76faa7564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530409, "uuid": "985ef95e-f29f-40a2-8cf0-1308a902b01c", "value": "24124eba208a4cbfb5fd03185c7b130d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bad9733-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659539487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539487, "uuid": "b65a9cd7-6fd4-4076-a1c3-9c9ddca0959c", "comment": "Malware payload (GuLoader)", "value": "fa1ba036769cf97b2282e991cfc99f01", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539487, "uuid": "5880ff1b-e3c7-4faa-88ad-7041427ba090", "comment": "Malware payload (GuLoader)", "value": "5c74363d6e8e20502805c734152b3cad88e6636426d88d6e044dc82139dedab9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539487, "uuid": "4dd487be-2640-4889-8799-cfe7d260c298", "comment": "Malware payload (GuLoader)", "value": "a37c4b3205de83acb3a99484c638c56b212fe07d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539487, "uuid": "f79746d0-932b-4537-a7a3-9b21d08d7dd7", "comment": "Malware payload (GuLoader)", "value": "d214237306c9eb755f7ec51372bc3e3de8896ead978b1b4a6fec1319c836ab0256652980e399d489bb1e5d505bde3484", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539487, "uuid": "c7481f42-0fd1-4f70-88d0-1f0d4cf270db", "value": "T17124A4916FB6293D5E5AE00B4E08487ED13E780B8B9230D6F6E7868F4D0613A73DED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539487, "uuid": "722e9e30-2ce6-46b8-b25f-9e8593fae600", "value": "6144:hj68Ri5q3zpXQNVtTq7RixHbUeHpeIXfkeW:hG8eq3VANGRIXcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539487, "uuid": "fa9fd0d0-79e2-4692-a864-08733de15aa3", "value": 220616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539487, "uuid": "da0722f5-0393-41cc-9d2e-c7db71bebee4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539487, "uuid": "7a97d56a-dff4-4095-a892-26365d5531c6", "value": "Sample Order_png.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446644d5-137a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659565137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565137, "uuid": "56920d51-4b35-475a-afce-be8ef13d607c", "comment": "Malware payload", "value": "aec4f489c61ed3b5d91471d3f9193afc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565137, "uuid": "1a41e994-2ece-452a-ad5a-586fdb062bf3", "comment": "Malware payload", "value": "5cc29ce11d270c27e946ecc3bcd6b86123746e9c23f8cb41f6ea7e524d367c87", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565137, "uuid": "207ab35f-259c-4a95-abb9-1ee3317d95b6", "comment": "Malware payload", "value": "af328f319c1c957cbbe3dfdf59f0b8431b2c1a8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565137, "uuid": "84020bcc-b237-4e81-8f9e-79ab30daabfe", "comment": "Malware payload", "value": "2b1cf92d6ae962fb8132f9042b07e2636966eabcd4eae7f78a67b1ec19ff7119543129cdcb45a871007e28394793aef4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565137, "uuid": "92050e86-ac31-4737-8376-3f9337c04bbe", "value": "T16E8622B344807EC7E2B683FA7C2685498C25F9728F461576F06F6AE1818605DCFF4BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565137, "uuid": "9f191be9-aa48-4307-b1dc-9cb4fe77a552", "value": "29b1a1b034fbd411fb01ab031590630c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565137, "uuid": "436f947f-ea40-4ac8-95f3-1b08d520e7d4", "value": "98304:ypu31wKVt3H3vGTEfmOsAPgEI2SLy2lI2AEFOLaslgDkfUnEUxKiPNr0Gv+C6gpS:tBjeT8bgh3lLJF2aso1n+tGv+WpFNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565137, "uuid": "24d0a6ac-b1af-47d6-810e-7d14cb780ccc", "value": 8028160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565137, "uuid": "33a6860f-26fc-4e3a-9ad2-97891ca7e5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565137, "uuid": "439af78c-66d8-4eaa-b4aa-7f5eed86783b", "value": "hckiurcorx.uuh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6c36e2-132e-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArrowRAT)", "timestamp": 1659532534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532534, "uuid": "1a02e6a3-682d-4745-83fb-b571a985467d", "comment": "Malware payload (ArrowRAT)", "value": "7b2ec8aedfd42a95a5994dff19115471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532534, "uuid": "dc88573f-15dd-432f-8c7e-260ec8edc23f", "comment": "Malware payload (ArrowRAT)", "value": "5d573461fbe87a4441a12b5b61a3b74019aa21a784f9cf4410e1da100a55c792", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532534, "uuid": "8e76d3a0-2347-4934-b64b-57a69d833609", "comment": "Malware payload (ArrowRAT)", "value": "f51aa65fc904272a1e344a57c436ba8632065b6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659532534, "uuid": "75bdd403-a599-4b4a-b31f-0fe88f0785cb", "comment": "Malware payload (ArrowRAT)", "value": "6077ea9bea968913c96394cfdb4488b3395c22a90671fb09662eb8f085769258baec621442867873560924b6e749860e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532534, "uuid": "ac69d038-9222-4c26-9e94-6251608b7fba", "value": "T15ED35B2439FA5019F273EF799FE474969A6FB6733B07A45E0091038A0713A81DED163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532534, "uuid": "ab83f901-5d25-46b5-87a2-753c88a6da4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532534, "uuid": "f1226025-3ac1-4c53-acbc-3f0928821ee1", "value": "3072:2bvik5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Y+:2bv5S7BqjjYHdrqkL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659532534, "uuid": "7bb474b7-694c-47df-9afb-f304d25ae9d1", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659532534, "uuid": "1d87e53a-0785-4479-8633-f9d0f1acb150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659532534, "uuid": "292e43b4-e6af-4859-8e5f-a8f77cb7d8eb", "value": "7b2ec8aedfd42a95a5994dff19115471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5037262e-12f2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659506745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506745, "uuid": "bff0a1ba-1c24-4312-910a-03fbd38cb3e8", "comment": "Malware payload (RedLineStealer)", "value": "0d501af7699b73ddc1390dad2b74dfea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506745, "uuid": "a1a9d702-26f0-41fb-ac10-504a38116b93", "comment": "Malware payload (RedLineStealer)", "value": "5dcba2271c9a480e6037d5c5d1c93e44ba643189143bd7f4248bd55658d9ba28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506745, "uuid": "6b17911f-f400-4ad2-8c01-3996c4625b51", "comment": "Malware payload (RedLineStealer)", "value": "87f0f235108ec5fcb7c19e6db90b4917908c74a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506745, "uuid": "5fb42c70-c3d7-48d6-b438-9a317aaa7a4f", "comment": "Malware payload (RedLineStealer)", "value": "8af287cb35b7a7e073adfee1f69aec0461d3e54c8dabc368febbd06739c3dcf911c3c2edb4afd2687c0c663c881e24e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506745, "uuid": "e5000bde-afcc-4d29-b8a5-b34cd70ffdbc", "value": "T1DBD4AF23B1D14437C1B62E7C9D5B67A4982ABE103E2C9C4B7AE51D4C4F386A17E38397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506745, "uuid": "73247dc1-1686-4955-b6ba-9bcecd4f43fc", "value": "52e7cafc79dba3cfb36776ad00e5b288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506745, "uuid": "d48b1156-8154-453f-8f27-2cc6fa4dfcab", "value": "12288:whXHiERdhEIaUN9xmODIoj1DyTMz5pfRaqfFKK0pMqVHa:whXCYZN9woJDyoWmKK0pHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506745, "uuid": "e12967f5-6a19-49d2-8021-99e2eb45dde3", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506745, "uuid": "85b5f1e0-71cc-45db-af49-18262ba54e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506745, "uuid": "295e7dab-1662-4fed-a093-a5e900ef3599", "value": "0d501af7699b73ddc1390dad2b74dfea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8719a3-12f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659506227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506227, "uuid": "f998db75-0af1-4387-93af-9ff51b4596a0", "comment": "Malware payload (AgentTesla)", "value": "0477c70aacc7b8b66d739be69ec521c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506227, "uuid": "a6ca0680-61bd-476f-b63a-1bc60473da16", "comment": "Malware payload (AgentTesla)", "value": "5e0f5ab73cc9fbc6520d32814b19d7f1a23f5500cf76be77353cfa7b6559455f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506227, "uuid": "5a50d841-cc5a-4d6b-94e9-538e7f145eca", "comment": "Malware payload (AgentTesla)", "value": "403d79da78c244fda2683279eb7131b84c23d044", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506227, "uuid": "f03da01e-24d3-4e54-ab9a-ebc18ad3c871", "comment": "Malware payload (AgentTesla)", "value": "3865a308361e4b92439fc82222f10adc1383434b6a296f9daf7e1940b76579179d73aa6e4ab4a4f0a4b8a46d2166cfa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506227, "uuid": "b8818ee5-b8d3-457e-8398-420ed650373a", "value": "T17C05E04172B98B17E8BA4FF2B5A440500FB376667423E34D5DC438EA5EB27434A0BB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506227, "uuid": "547d4b69-5501-40d2-855f-1ae4c9f9ac42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506227, "uuid": "c40517c3-e6f9-4bed-b913-665d70a9960c", "value": "12288:Qe0Kg6SKlpxFqgvMYjUQcoZQanL25q6aK0/STtt+:oYLlpxsc7ca25Ct6f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506227, "uuid": "1478ed64-9f3f-4392-9261-f290e5b78357", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506227, "uuid": "fb3a4768-dcaa-4700-8f0f-f1452a815430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506227, "uuid": "5279e583-7bcf-4289-9422-da49b2967e79", "value": "Quotation 60009111630000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4f1fba-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659507572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507572, "uuid": "7f34e46a-3d09-433a-9dcd-7d9dfa11aedf", "comment": "Malware payload (CobaltStrike)", "value": "89d34fb9ca64d71b6c01b5254a251fa6", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507572, "uuid": "6471748c-622a-44f0-a271-f2692efd743a", "comment": "Malware payload (CobaltStrike)", "value": "5eeb919530fcdca6aa1235d08b4af3e77f65e04d0b1b8172d79e7b73a5254ae6", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507572, "uuid": "95539b00-492e-404b-af82-fe0ae2e43f81", "comment": "Malware payload (CobaltStrike)", "value": "dbd07af5367cc841665d5d4df632850ca7b4da64", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507572, "uuid": "4ffde44b-678c-4567-ad41-44a2038684c7", "comment": "Malware payload (CobaltStrike)", "value": "e64865a64b6283398b484684f5ed17f0d347276e5694df6ffdaeecc13dc8a720bb56051e404342977738fc9ff80d458f", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507572, "uuid": "70c53290-e6ac-45a2-b31c-a2d87ec42f38", "value": "T19B152A1BF76344EDC67AC17086678772BB70F82416306B7E2B55CB352F21E604A2EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507572, "uuid": "480226bc-21d2-49b6-bbba-6cc04695cc31", "value": "0f6777bf8d57b5feb74373fd100eae71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507572, "uuid": "3230fb02-56c5-414f-b46b-7975fdc8fe60", "value": "12288:nI1U8CBZdB0DEJ7NzqPSHuFsuy78Gmrn:IlCjdB0AJZkZFsurL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507572, "uuid": "414411fd-dfc7-4432-a582-5080295b1aee", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507572, "uuid": "e93db7cb-6d9f-4892-9ed7-e6d5167d4cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507572, "uuid": "310d24be-faea-458e-897a-2df66b3db376", "value": "hack (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087447fa-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522516, "uuid": "adb81b24-0ee3-4965-a3f1-43a535364448", "comment": "Malware payload", "value": "fdd9a44f07b7ecc266995584cd0666a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522516, "uuid": "306d24f0-491f-401c-9eab-3c0b124ba037", "comment": "Malware payload", "value": "5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522516, "uuid": "2bac4a8d-5513-45ed-b9bd-17f9135d6e01", "comment": "Malware payload", "value": "33eeeaf2487b06335411f94a1035e20e655936ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522516, "uuid": "9628ca2e-caa4-4eb1-9066-f3eb40330957", "comment": "Malware payload", "value": "3dbae156f3c57e5b0fdfef2cf92a392d3537f4fb6d33eeafd2369401e430b517a4dc276fec348222135e59e350118b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522516, "uuid": "5f0cd8cb-04d6-49bc-ab14-9cc20f105b03", "value": "T10FB501A6F944AD37D03106F0A59785ECD6727DE41E21C13F22B4735EBEB22E41E36292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522516, "uuid": "244f1200-dc08-4454-a45e-b23c1267b5d0", "value": "516a7ee1ea18e78c2426dd594173d49a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522516, "uuid": "b1885800-f314-45fb-8093-4f0da46f0018", "value": "49152:ZaMB2q7+d1AApkwXErmOEjK+URN5gEikHawf3wl:Zloqqd1A+kwXRO07UjHawf3wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522516, "uuid": "49d9fd5c-53d0-431c-a840-fa094c7d7c72", "value": 2453504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522516, "uuid": "5767738a-7d6d-4216-9135-e0313784104e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522516, "uuid": "db5f5b68-5d91-45d9-ad0f-bca9963b431c", "value": "5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bd8db7-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495082, "uuid": "3446154d-008f-430e-a6f6-af7a263587da", "comment": "Malware payload (Mirai)", "value": "303065298dcb1bec91125d0dff48a12f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495082, "uuid": "3b1df9b6-8b33-4af4-91d9-96a7e09c4354", "comment": "Malware payload (Mirai)", "value": "63fb8fb1cdc455aaee000140d0282da46199bb23e7976b4c156cadd3a064a542", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495082, "uuid": "2dcefc05-c1d3-4738-b235-f29d1a270e91", "comment": "Malware payload (Mirai)", "value": "ae940237ce25282d5f8427c8cb5247162f31c45a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495082, "uuid": "1e772e47-7e0d-4262-8620-50afb6c65d10", "comment": "Malware payload (Mirai)", "value": "337c3f8975c0d358a55c00949f529f015375473eafac4efd317c9a68f0fdaac10db510e6d746a24eaae1e9d4ac2ff505", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495082, "uuid": "2d35403a-1bea-46b6-a040-489c2ddea33b", "value": "T1E7A2D025D345AEF4DFAF5DA053C1C2C27AE587C6268AC8E340EEBF026516046B788D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495082, "uuid": "6245e368-cf45-44fe-8929-be2781f2baeb", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5qBM4uVcqgw05VxJW:mRxsSVsMD6xiJJE5zRWN74uVcqgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495082, "uuid": "36227b85-360e-4d16-afd9-5ca5d9e97576", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495082, "uuid": "82206562-b4e7-4367-9942-af15156a6514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495082, "uuid": "9ab73241-9fd6-4981-a102-4ace0721fe1c", "value": "303065298dcb1bec91125d0dff48a12f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994607f3-1305-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659515028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515028, "uuid": "837c3cb7-a6a9-44e8-9dc6-8028597bb7f7", "comment": "Malware payload (Formbook)", "value": "118f678b684f974f649e92a5fe07d643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515028, "uuid": "bc529626-870f-4fa5-a06b-804e8a57ece1", "comment": "Malware payload (Formbook)", "value": "645b7f4cc5a9ae0e723f88a4189d607c9bb2b3499b31f5f2bedef3b09a0ed62b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515028, "uuid": "e9aea32f-d0b0-43af-8a45-da1d74e09996", "comment": "Malware payload (Formbook)", "value": "45c9a8430337b5b6fd02032cd199217662086fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515028, "uuid": "a3fe2793-c1b6-48e7-b4da-2c79b883ec81", "comment": "Malware payload (Formbook)", "value": "594efa155f99a36ec446e2e342000c4d333ad3de0a17f0a29e5914da6c996ce41d9b0fa89758ba759256a081ce9bf2cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515028, "uuid": "1f94ccdc-1f03-4d3c-ba83-98030198b2a9", "value": "T1DAE412E5325B461BD47A19F6A21044949FF0932F6097E2CA5ED23CF7A4FBBC3464068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515028, "uuid": "305e2d98-490a-4932-8d34-4f0ddd2f564d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515028, "uuid": "d943cc25-e5f4-4afc-affb-642251021499", "value": "12288:ZrLTg6SKlpxuz8G/XgIeaEqgWnmezkvs7bUqXlgG7xXxbzEUkB:FhLlpxux/XZfgwmT0ZXltbzEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515028, "uuid": "4d0310f4-c00c-4a03-81e0-bb81e0443d2f", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515028, "uuid": "a1db2aab-23ff-47c9-bf84-73b59b584f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515028, "uuid": "98d8ce13-1ae7-48fa-a97a-85ead95d8533", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa45217-1350-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659547358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547358, "uuid": "d2bec908-689f-4dbb-a5a0-4238e32f1457", "comment": "Malware payload", "value": "9303af8cf2384b61cd179320da53d88f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547358, "uuid": "9259adbc-0fc7-40a3-b922-b7a597d3f5e5", "comment": "Malware payload", "value": "64d002099ceefa7bcfc631c8eca3f5ffd650c7f758d11fbd94f4d0ef6e0f9c42", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547358, "uuid": "6d6e620e-427d-498f-a1c6-a3f853a5178b", "comment": "Malware payload", "value": "b8e622fb390ecbb0b72d0ea983352270c6bd0dd7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547358, "uuid": "2943fe67-409d-4957-b99d-dce36c80bab8", "comment": "Malware payload", "value": "6bf040d7a7d01a9d92c9e47215859f8ade820dd9a80e15a5129db72711e64ce1e03cbb31fe091aeeb3afb92fb5c63874", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547358, "uuid": "32d6d7dc-a3fa-4105-a06f-80b591aa4252", "value": "T1A794F723A3451373C1A30274AB4E6AD6F33894B8676AC66054AED07D3343C75977FAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547358, "uuid": "176dfbff-56d0-48e7-b289-5de42b1bd9d9", "value": "6144:7S0C10BSBbfElDUbqUbVbsXzbVOWMbwolDPHbUjW/hYaXVWQzWJEmplD+MbLlD+H:7S1v9Rbgmtjd5Aby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659547358, "uuid": "e1a65f9f-ad88-4b5c-8efb-712322cd22ba", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659547358, "uuid": "0b8c0fde-0ab7-4ccd-be52-663f7b2e1531", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547358, "uuid": "51f4fb4a-f878-41c2-b262-dd09c596add9", "value": "August_8406_pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0859300e-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495028, "uuid": "635c96c4-1a44-4364-9f5d-67c144cdcd2b", "comment": "Malware payload (Mirai)", "value": "cf93cd92259847ddabf4b06197bada15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495028, "uuid": "4aa58e9a-373b-4aed-9102-dfd74ea1f3e6", "comment": "Malware payload (Mirai)", "value": "65cc96c5dac2937bfcc40d9942ff63ca814564dfe2d0bab9e5a5f89425a854fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495028, "uuid": "5417a6c5-f8b2-4eba-a246-fd041b0875ee", "comment": "Malware payload (Mirai)", "value": "4d430041f77bd1eb0c59d8ab8757129ddfa2d755", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495028, "uuid": "0234d8b9-9fd9-4857-8ef1-9433e98df2c9", "comment": "Malware payload (Mirai)", "value": "01dd4e68a64ead0f477d410de74d00f710da406d21582d9b153220d80560b78cdb33018f908930aea454c1385c3e30ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495028, "uuid": "5b53525f-60df-4173-b58c-acc7c151235f", "value": "T136935CDAF8019D7DFC5FEBBA44230909B530A31576930F2A679BFD537C721A82912E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495028, "uuid": "f006fd94-9ff0-4717-873a-368f5da91dcf", "value": "1536:nSbNXgZmF4fJmlkqZH6MW3Uc7Z4p8fEyq22aosrtbWXyqSQdybMnnl92JB7/8883:nSpQZmAgms6MW3l7Z4zyq22/7SiyoiB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495028, "uuid": "6ec4cead-1386-48d1-a29a-388191a8dbc1", "value": 93072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495028, "uuid": "1793516e-fe58-4045-9ffb-a52e0c3e31a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495028, "uuid": "e85bbcfb-f847-4531-a4e3-f19c871d0db2", "value": "cf93cd92259847ddabf4b06197bada15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4490b5b8-12db-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659496847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496847, "uuid": "cf8f9584-d669-4f0c-acd6-3d5751a1d8da", "comment": "Malware payload (Stop)", "value": "b364bce0feec51f342aaf38f0b291723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496847, "uuid": "c2b8278a-071f-4fd5-907a-13c750905df8", "comment": "Malware payload (Stop)", "value": "6718c35947bf87c571c55debaf8e71aa017162ac6e3b9126f670ac94817f390e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496847, "uuid": "ffe91ab5-30b9-4834-b7d2-0465459a328a", "comment": "Malware payload (Stop)", "value": "f1673f6ad09372ec3da24e938ebf6805a57d78d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496847, "uuid": "eccb4762-6013-4fb3-94c1-fa05eff9da4c", "comment": "Malware payload (Stop)", "value": "39fe704b874d669dcef3c5d5ca5a6f5f392d07668de9d24f1e017f296843bc2e3eaca691235e29fc4973510b2569f17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496847, "uuid": "866b265e-bf40-4b11-99cc-99f078884a22", "value": "T1EC150100BBA0D039F0B362F4BA769368B52E3D915B6455CF12C56AEE57346E0ECB1327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496847, "uuid": "1ba8e882-4040-4be3-bdaa-ddc76b1e7419", "value": "7b13e4090c99826947262651b64e9d68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496847, "uuid": "de161774-7013-4b56-9d2c-3f0e39ea2eb9", "value": "24576:YwHE00TGFZ6q6CElKUgXUUvNyaukZxEXbmjE:YdEZaCEAXU7au1EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659496847, "uuid": "8fdd45ff-cbbd-4965-a1dd-c8527566105f", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659496847, "uuid": "638d8057-6cef-4e80-b548-a8227b5b3e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496847, "uuid": "61428120-8bdd-4f7c-a90d-88c8b81e136d", "value": "b364bce0feec51f342aaf38f0b291723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107f502f-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659513940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513940, "uuid": "7a746fd7-56a6-4cc9-b69d-3d65dda06e21", "comment": "Malware payload (Stop)", "value": "349e0d8e443567ff27e1f1fe5a85f775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513940, "uuid": "6658e3e3-16b8-4e75-9baf-75191123719c", "comment": "Malware payload (Stop)", "value": "688af7fad79c9afe7b00646aaaee46d2328a8c5d10a71865d11447b98af905f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513940, "uuid": "18759279-033f-4ea3-8cc3-c6aee120fbc7", "comment": "Malware payload (Stop)", "value": "0b76661e68c5b8e117d89a0377c3df44bebf41e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513940, "uuid": "02d3b2b1-7892-4ae7-8c35-54ec691c3002", "comment": "Malware payload (Stop)", "value": "9bea1a6934cb769ad4f23dfba00be50d90dcd7e0191171a750c72c0899b28707f5bbd90ba41148aa815ac32ba9a64adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513940, "uuid": "5d9efbd6-1331-4685-94df-62f9a0d35041", "value": "T1F9E412E0B6A0C032D573AA7055A8CB694ABBBD36CB744987E7E4136E4E3D3C04E36355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513940, "uuid": "0a734735-6fe1-4728-8656-609380cad078", "value": "16efb6b0368de80f5b2f8ee7ed5ecc80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513940, "uuid": "ba1e50b7-bfa5-4d43-887a-cd9b6598a408", "value": "12288:LhUKgKMB6BIK/GAakMlw94TTUct6UxWEefW9BVJzb8CHlSQ+gvYKB/3:LhUKg07/GAak0AITzt6UxWEZBVlb7MKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513940, "uuid": "e53fbb4c-8c37-4c97-b9c5-e1e14a9d6f86", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513940, "uuid": "765c7a19-f03a-4aa5-93a6-c539d9280864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513940, "uuid": "46d19770-baca-4fda-b8f2-1018912dfffd", "value": "349e0d8e443567ff27e1f1fe5a85f775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fac8083-12f6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659508355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659508355, "uuid": "2c40216b-6976-475b-8081-964bf7ac9c8b", "comment": "Malware payload", "value": "0e593549e712398a9f64a4c363601650", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659508355, "uuid": "25d7a8a4-7c6e-4aa8-98d5-989f6d543c1f", "comment": "Malware payload", "value": "68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659508355, "uuid": "74664d3a-4bb4-42c2-968e-d07f3f5f3c98", "comment": "Malware payload", "value": "4f74b03d330993674607793cf80e985887ad88a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659508355, "uuid": "7013ae1c-c68b-4b7e-b5d3-81adf6435ee6", "comment": "Malware payload", "value": "d859d5cad0c1b771993d9853bc7f858a2f72921e1302f2ffddde391ebc6165028b25255fac1f9b0c0678078c3a5bb5e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659508355, "uuid": "f4089e7c-9939-4459-8e37-57b2a6fe6a4f", "value": "T1E6C5339FC788F99FD15ED535A32DD752668822422F8974BB4FB4B4CA58D3D422F0202B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659508355, "uuid": "3c59d2f0-07dc-4e50-9be8-6c9787ef0f71", "value": "49152:PjHNQSUekcNUk+C87dFCjhHF2snQJYIaFPrwdGMTOiNrimkq4Puarzg7:PrNkl9dFkBQJIFAsisagukzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659508355, "uuid": "9a042381-e38b-4699-863f-2df39afee03f", "value": 2665132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659508355, "uuid": "533f43d5-4572-4d8d-be52-3a636873be62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659508355, "uuid": "33f7b146-7e6d-49c4-baea-92910ad45268", "value": "AssistenzaAvanzata.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6c8ebc-1350-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659547410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547410, "uuid": "3b453112-ff75-4928-89be-b12504e7b8c2", "comment": "Malware payload", "value": "b58403b0f8b5e82d82066eb8a67a5fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547410, "uuid": "340738e0-4797-4242-a2d0-a952de81ea90", "comment": "Malware payload", "value": "6942bdc3fef603f86e7c33e427668c15ea38401bb7a0fec693ac6bc8d9156021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547410, "uuid": "252ef40d-5d09-483e-b3e8-8f42cdc5df3f", "comment": "Malware payload", "value": "1d00e5edf256f82fca21edd198cdc72179b237de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547410, "uuid": "fd4f3c42-8c9d-4583-b2da-5446e334c5bf", "comment": "Malware payload", "value": "ed928c49b18a9f79950119a9708bf7ab14977dc53688b7017d4b80b42f7c1bef2f27f6f1bb7de6632d662afa53232790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547410, "uuid": "191321b4-73d4-48f0-aa92-e614ddaad384", "value": "T125535A20E782D5E3D4690079C5857DEA62727F55CFCCCFCA4B28BBE20563A21DB0AB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547410, "uuid": "c447df1f-6a63-4988-8f82-495d174542e3", "value": "0df6443f076d43488707a8a4a49aa249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547410, "uuid": "b47766b1-3942-4ef6-bf42-526c1c8f5088", "value": "768:Iy6AL4Bo8A6U5gfg5KJ6XkmYhCuJDaq3bT9BuErfUFAqwIsDJm0EEj01bFB:Iy7j8S5sN6XkfaKbp4EAGqwJJj41FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659547410, "uuid": "8fff7246-762e-484a-87a3-416a40774a6e", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659547410, "uuid": "9a06ce12-9629-4cc1-8930-bc50cf505afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547410, "uuid": "277f100d-078d-46ad-aaf6-1e7bc0beb1bf", "value": "hisTheseSheHimThen.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740ab48d-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659542453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542453, "uuid": "5a5a31c0-1471-488e-9747-72791badcb25", "comment": "Malware payload (AgentTesla)", "value": "3bba493ba5a5f9500ceadd4291c83acb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542453, "uuid": "9730fdf7-100b-4bf2-a3aa-d9f897baa306", "comment": "Malware payload (AgentTesla)", "value": "695fbf5dd7c6f62c0cb053904f9b5f42edac126ffb6f4b7f3b24f79916024f8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542453, "uuid": "c40904b6-fcdc-46c9-b61b-e403b20b33ff", "comment": "Malware payload (AgentTesla)", "value": "f64c20e705b5fcf8c1b3312be6eb4006064f31f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542453, "uuid": "59b50264-92f6-41a9-ba13-5bd334c6ba1d", "comment": "Malware payload (AgentTesla)", "value": "20dd050fc7b6fe1fba95c22f31a2a7d47e2244d24f702e24e6e9ed57b318084eb4ec1277909f1ae6a41f392a3531b03e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542453, "uuid": "93b7fbb1-5065-49a8-90ef-739158ad1dc5", "value": "T1CB05F14133B98707E4BA4FF6B4A040541B73B66A7527E35C5DC938EA5EB23434A1BB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542453, "uuid": "98e18e87-c976-4b68-ba62-05b8746ff03c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542453, "uuid": "1dd52a4f-5e76-4611-8428-d389f78937ce", "value": "24576:Xe9Llpxz2pgp6FnN4wrgmaLEiN52CIYJ:XeHSpFJNT7Zg53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542453, "uuid": "e5001b41-bc6e-44d3-a008-27d2f1024c64", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542453, "uuid": "d0986cdc-fb8a-40cd-9e8b-8293333eac3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542453, "uuid": "516e85d7-4209-4679-b12b-ed30414c8543", "value": "Waybill Docs_7093409987_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5c2d8d-1386-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659570277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570277, "uuid": "0c8554fe-5ed8-46d8-b728-bef04ba2f5d4", "comment": "Malware payload", "value": "11b2f801efec3c8eaaa7575973ff2d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570277, "uuid": "7ff66a63-68ed-4189-9014-8991a051311a", "comment": "Malware payload", "value": "6969b05f1364266bf3f48e18473221eaa5f4a0a099a62f2c5c52cb450c670182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570277, "uuid": "97f874c6-7630-41c2-9ca2-0ce40a5ef258", "comment": "Malware payload", "value": "9b40b1caeac433af11696360d214a665a9cfd9ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570277, "uuid": "59f9cde8-4517-4ed0-98cc-f3837fab94d2", "comment": "Malware payload", "value": "b363f73e21924b59f5af3e961e38df0047b950d5662c402d64aa56a3953c4e3bc0886298006869e4d5762849726417f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570277, "uuid": "1528a76a-42aa-49f2-992f-6f845bb158c4", "value": "T1DD733A1A78D3C033E8450874C5D186C15FFF9D2376D6946FEFA9068E5AA02D806BABF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570277, "uuid": "35905b25-7900-4c55-b2d5-24413a548a5b", "value": "62309a495c8c304259f74d2c7a6b9f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570277, "uuid": "bf0c5e3c-ee97-442d-9537-71a97964cc1e", "value": "768:eAwNCKTBTxbgEq2RJH6Qe3qx5AUjp/bug/9ngYm7zxG7sRq7J/+qL/b+khmbJrw4:eHEmTbNBJHLcU1/bat3Rq/+c/hgK8t+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659570277, "uuid": "beff959f-8735-413b-b386-e7225dfdd444", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659570277, "uuid": "dbe3e385-db4a-494c-b601-18ee85388c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570277, "uuid": "07fcfef2-5b26-48c3-914c-04cf869eb13a", "value": "11b2f801efec3c8eaaa7575973ff2d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32944b83-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659511849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511849, "uuid": "8ab650f3-9508-4ea1-9939-e69bb3594f7a", "comment": "Malware payload (CobaltStrike)", "value": "bb3e4f9e07b83aa72b95feaaf629081b", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511849, "uuid": "9db89277-40de-409e-8eed-8dee1b78ffa5", "comment": "Malware payload (CobaltStrike)", "value": "6b29e5767995b6a67b05eddecb393dadcd207bd06e0063837feeb8fe070e6780", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511849, "uuid": "4051f2ac-a880-4bbc-9bee-d84a7f13fc3d", "comment": "Malware payload (CobaltStrike)", "value": "30493064d3aef5ecd8ab6edf75238db799c2b5d9", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511849, "uuid": "d26f13ab-5e02-48c1-a5e5-c3afbfa0c861", "comment": "Malware payload (CobaltStrike)", "value": "c1b9566cd6597553a2ac2e57ffdbec8e37a7523a60fa93136e4e349171762103960358192048854eb09fae9cc9ef200f", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511849, "uuid": "4d13f3b9-52fe-4d3a-98f9-8197b938a19a", "value": "T188A3D78302B99D34B7F1440342E1FC2D58AA4C625C319C46BD9B36ED8B31A6D65FADEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511849, "uuid": "6c44193b-6edf-4cc8-a39b-5d324d28e14a", "value": "768:ps2HZumg4gjNLILTfC+g+7Yr7sdNarKAyzdS2RAlXGoTu1e5KDvEUwJJtCD9I:p9H8mOcTf7Yr7ZKAqVRAlXGqgoUw1CD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511849, "uuid": "add2a139-c7a8-4b85-b591-8abb6b3c9595", "value": 99349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511849, "uuid": "a8a0cc08-aaab-4248-bc3f-c28091e05959", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511849, "uuid": "44c5ab9f-ea40-4603-9dcd-853465cce23f", "value": "1c.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001860b7-12fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659510047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510047, "uuid": "4dfa8c41-fc56-40bc-b20e-0091d8ca360d", "comment": "Malware payload (RedLineStealer)", "value": "39f238c30fed47683a060ab2993cf6f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510047, "uuid": "500b0ea1-7e57-467b-b254-6f4540d53a32", "comment": "Malware payload (RedLineStealer)", "value": "6c67e4d819380e6098d12eda600e8f6e69d1e2a29c66c15edef0f9b97dd2137e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510047, "uuid": "9151e4c3-0970-4dec-af5b-f0dec0568ee4", "comment": "Malware payload (RedLineStealer)", "value": "faabe801fff16ff803fc4cfdff3e7171deae2c0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510047, "uuid": "b1f01469-4dc6-4bb5-bf79-5908d649032f", "comment": "Malware payload (RedLineStealer)", "value": "2265eb957e240d38ec72d6e1986a3af17a095bc138ead320011ad8f54e0e8a86cd2d2689aecbeff6ac9312d9b40b2fc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510047, "uuid": "3e631c6c-0184-4c3e-96a6-e640fef33417", "value": "T1F2F1EAD86424B2D5CA24A2B139183CD8E3ECA61F52445B9C382EB3811FF3194D2DDE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510047, "uuid": "fdebcebb-c95f-4d90-a157-a791405e7319", "value": "192:OnRCfgl1g0L+pu4tXJgM5fpklmzqBR7FgeGu9mKmRTz/JyWvjSpmzUFkyYR9kgEQ:O1v9mRJyI/YeyYRyHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659510047, "uuid": "6a971fe7-baaf-48c6-9e1b-06da94012cf4", "value": 7645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659510047, "uuid": "e391f8ff-b606-4e88-8308-9b446702889a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510047, "uuid": "8cbab06e-9b62-4850-b371-82d95931c0bc", "value": "etkZTYUCurtbuild.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457fc43d-1315-11ed-93bb-42010a9c0043", "comment": "Malware payload (Pykspa)", "timestamp": 1659521759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521759, "uuid": "62e3818b-19b6-4fb6-b985-c538efdba448", "comment": "Malware payload (Pykspa)", "value": "2d9464b73acf20811f382de9907c0e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pykspa", "colour": "#9E62D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521759, "uuid": "c83e409d-2e2a-462b-8bf9-bb9dc65640a2", "comment": "Malware payload (Pykspa)", "value": "6c6aa247345f7f3a31f7a15c395eeac21409fda66b58d46a0014ed96c2a38b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pykspa", "colour": "#9E62D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521759, "uuid": "f22427c5-21b0-43e8-ab8a-b301c709e6ca", "comment": "Malware payload (Pykspa)", "value": "529b6b5a7014343cb21cc8c627d8cb1fa5d960da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pykspa", "colour": "#9E62D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521759, "uuid": "cd0b8b23-a1ff-4f92-bacc-49bf429733b1", "comment": "Malware payload (Pykspa)", "value": "2e660a37c5993ae59cc04cb1ee37a4fbfb7bfb4f35ec349f9f2e860357bdeee1ea826fae37af25f80ffa094c71e1a0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pykspa", "colour": "#9E62D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521759, "uuid": "e3353774-6bc6-4fc2-921b-378a7b5fc48e", "value": "T18364B03BB780C8F2C485803176996E136EF56C301625EA5BDB60DE0A2EF55E4D72A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521759, "uuid": "8f89e8e0-100d-4636-8662-407fad4e6a95", "value": "a1161b9f4081312e64af594f73664c29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521759, "uuid": "36c2053d-adba-484f-89ad-b01ca0e5688d", "value": "6144:ATwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:OXgvmzFHi0mo5aH0qMzd5807FRPJQPDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521759, "uuid": "4a1d75f5-4708-4f21-805c-2d1ba05b644a", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521759, "uuid": "8977ab0c-c703-43ef-a298-e25c2ccd943f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521759, "uuid": "e5f96e98-bae4-40ee-87b8-4078483cafcc", "value": "6c6aa247345f7f3a31f7a15c395eeac21409fda66b58d46a0014ed96c2a38b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b8b60a-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659512742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512742, "uuid": "f75b52a2-ba2c-4694-bc12-a85e2d402a8e", "comment": "Malware payload (RedLineStealer)", "value": "e49704a2ca2d2e5eced710444de7fc2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512742, "uuid": "a9b1133d-b6a7-49f6-ad93-32331931620f", "comment": "Malware payload (RedLineStealer)", "value": "6e3c58250894d76bdcf7ffc6d337789aaab63958bf68e0472558704649ada679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512742, "uuid": "c010e593-3728-40be-bc71-38e847cc5784", "comment": "Malware payload (RedLineStealer)", "value": "6cb9c782486971dc36fa45581095c80aa8545ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512742, "uuid": "0b970b92-a85e-44c4-bdd1-68cc68894b19", "comment": "Malware payload (RedLineStealer)", "value": "9dfb7897eac3cfe59944fe506e89d7629f2b69b2cc8c691f93184729acf3f75b6137f16d9f97096e6b4163f53b47bcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512742, "uuid": "2345bfe7-7470-4d7c-a420-0f08f2d587dd", "value": "T1C5D412813AAA8B13F9354FF2B422C1968BF5B97B6522E2845DC53CF76471B630E1071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512742, "uuid": "18527754-24b2-4aad-b81f-8d7bcf37a59b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512742, "uuid": "699190af-7587-4ee6-9776-5623400f9af8", "value": "12288:Og6SKlpx+rwLw+XHHfTMZi4eGeZ/BjrBEHW0gpaHI5p:MLlpx+rB+XHfTMZQGE/B/C+Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512742, "uuid": "4372dff2-2311-4434-87ac-455b9d3c1759", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512742, "uuid": "f65d1455-17e0-43c3-8241-8601951c3bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512742, "uuid": "5766f358-0557-46c2-86df-389adde6e373", "value": "New Order PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9d3684-1306-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659515305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515305, "uuid": "544bf960-c5b7-445a-a201-287b60995f0f", "comment": "Malware payload (AgentTesla)", "value": "109684e8bcfe10025cc3f2d52d8800fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515305, "uuid": "2c99a675-e430-49d1-86dd-d4e3f590aee1", "comment": "Malware payload (AgentTesla)", "value": "6f13aff392dac1779040e557841a52099047b490c5a30168f660881dba349d5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515305, "uuid": "f8a1aaac-cd9e-424b-a119-75b62e8ae0f1", "comment": "Malware payload (AgentTesla)", "value": "f74bd8146b13eac007f44534044d3faf54463938", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515305, "uuid": "7e1e58b9-3881-490e-b81e-6606745671ee", "comment": "Malware payload (AgentTesla)", "value": "8014fc8ba2180dbaabd1a72796e202601c21d5ba449fa61319cd790de316018d3d892a85d6cae0335e87890b69e1f4fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515305, "uuid": "6a9ccf1d-79b5-46e3-abc0-ea2e74ed71c7", "value": "T1CAE4AD2121D6761AE0294F3B8BD094A45BF1FD02F709E5662EA03387C7F3EB08D56D62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515305, "uuid": "ee950bda-a979-4554-938c-0b2df0e4f795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515305, "uuid": "28c617cb-483a-4094-991f-410ef655561c", "value": "12288:wi07uOmChLuyAHk2iNKsUSl+G9WZj0xmenOz8+vZ0HUT/f7:ShhLuyyk1lUoBwZj04yPsZ0MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515305, "uuid": "4dd538dd-bf2f-4055-bd2b-d76fc9c95c91", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515305, "uuid": "b2ca30ac-d373-494c-89b4-78b159cc27da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515305, "uuid": "e5395d85-10ea-4fa1-ade9-32046a21a952", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ae570d-1305-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659514994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514994, "uuid": "2fa9ea63-7f62-4e53-81c3-f03eec0df983", "comment": "Malware payload", "value": "b853ae298d874add166dcb1cf552f276", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514994, "uuid": "30f4cd60-a138-43bb-a543-8cc8a60393ca", "comment": "Malware payload", "value": "6fff03a5b2e69d3e0fc91be6d24a3dbbd37e490214122fa2a1ea6e80acfa2131", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514994, "uuid": "0254dd29-3204-44fd-9a2b-3df3d892d594", "comment": "Malware payload", "value": "618ab8e3f10f03beb922aa515fc2f0cb0af4df8f", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514994, "uuid": "b5cd9a3e-3d75-49e9-9481-d7f3de419388", "comment": "Malware payload", "value": "7a06c2aea32c76dacfa9654e9abf622a257f7f0e928681d3c5ce3860b40b9e0bde0ec95e75818e52fdbdb1168973a97e", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514994, "uuid": "1dc14a8e-bb61-4470-805f-231cff9aa76b", "value": "T1F3124B2BE6D0FC1DC6338D3D810901F6BA4E20316E467A8A7495B65F27872D7478F4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514994, "uuid": "2b335568-0d95-40f4-bcda-3b8bc53afaca", "value": "192:IEElIO3w9CCTgUaFUlbVvevUqzrXjJ+Aqy:IEmz3YDsJUlM9zrMAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514994, "uuid": "68343c37-3d24-40f7-a9b2-7c9b909a932c", "value": 9374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514994, "uuid": "64c2d263-d7a1-49a2-81ec-1f4b7873a5c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514994, "uuid": "eff0c035-c05c-4b30-bf97-d1a594853743", "value": "reportas.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1367786-134a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659544703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544703, "uuid": "e81506c2-793c-4b45-a4f0-10e7f903a006", "comment": "Malware payload", "value": "364d39d38f15b4fedd2a7c0223a6c033", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544703, "uuid": "4d63c076-3a0a-411f-b7bc-ac2c2ba4c7e5", "comment": "Malware payload", "value": "706e51d26159ff8ba3bb9fe6af960f1a7bb0cb24b576edf41a5b739df7c185f1", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544703, "uuid": "4db68852-37fa-424e-a986-0afc2b850fe9", "comment": "Malware payload", "value": "008fc1e67e4607d68fef8c55306960cadd5176e3", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544703, "uuid": "2ed0e7fe-2115-4cae-b5d4-5e9a7682e303", "comment": "Malware payload", "value": "27413e849acbff1d5ca48c393a04dc9bff7948913b0385be4a88fd06aa473359ea810658fd97805e820a2bc02f1bb0b6", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544703, "uuid": "1ba31e7a-cb17-44f6-962e-51b557a9de7f", "value": "T10D222D95BCFC10C56817A2B145B4068FA36FDBFE0652397271FCB274291AAB5EF1B408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544703, "uuid": "a0cc7547-3d7c-4882-b1e3-c2d616379023", "value": "192:kIANDNpe+W720DiFVAUnsAHCWzfCTOOOObJIvQvg2A7GeXx592h04iJI52ys5vi8:SNfWmFyiDOb7zANB2h0TJI52F5a2VhbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659544703, "uuid": "d0597eed-1190-4a26-bd36-62156823ef09", "value": 10704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659544703, "uuid": "5e886cf8-2328-47e7-8cc3-7a11769afe16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544703, "uuid": "edfa7007-e8dd-4286-ac71-92517046680b", "value": "iLsqd81V.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2042d9-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659539484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539484, "uuid": "f623b986-33b7-4c61-9385-57d7bc99b54d", "comment": "Malware payload (GuLoader)", "value": "bac348077c76250e0cad70fbe37e1f23", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539484, "uuid": "327183ea-c07c-4777-9f61-df1597720d01", "comment": "Malware payload (GuLoader)", "value": "721842e7016707bbc8de33df71b3fe119b6785f83096c5d21ec39b4065ed3f13", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539484, "uuid": "f7ff7067-0878-40d2-b868-4914f221e107", "comment": "Malware payload (GuLoader)", "value": "800988d11ec2a82928156076e089bc30503f9e0e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539484, "uuid": "b088c83d-beeb-43be-a104-50e5b9d6fed5", "comment": "Malware payload (GuLoader)", "value": "78016e45da14f962d104477dee707e85c2f7fbb0b3850f0623dc6129994335d223be13b1559435eee5c749f8b4373779", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539484, "uuid": "af992acc-2041-4070-b350-62c428597b6b", "value": "T18624B4286FF6113E9C15E247CF09893ED8F97A0B0461B09078EBE68F4D1259B12F9D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539484, "uuid": "041cdd02-7ef5-4a71-8bd9-978259b506e1", "value": "3072:uNlF/27JhyXKZVzrCwynd4U11oXvX3hIFuwG12Rx4cHhf/dIxZ45lUtIX4CkeW:C27y6Z0aOwpmVG12RWcHBOwKtIXfkeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539484, "uuid": "c7e4ca46-89f9-4059-a608-31f7854df307", "value": 219234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539484, "uuid": "68f77727-1fd9-4f17-bff6-6cd64d275eab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539484, "uuid": "ed0b4a68-07df-47ce-8a4c-3d386af01a2f", "value": "PON3029388293_jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6418f30-1315-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1659521949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521949, "uuid": "cdbae5c6-6f20-4047-8e61-430011a76469", "comment": "Malware payload (Gh0stRAT)", "value": "4ef0f866e2a92cb31ac0764700c82ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521949, "uuid": "2c279f2f-9667-4fb3-8dd4-6ded9cf14a1f", "comment": "Malware payload (Gh0stRAT)", "value": "727a3d9b0884726b8aa69b6368ec32032c36645c6d82a33ae569d2c94f94f4dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521949, "uuid": "03e5242c-d8e9-4bd3-ba5d-b528ef925015", "comment": "Malware payload (Gh0stRAT)", "value": "ab061a297b232168508abfe04aa3c7da80fc5018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521949, "uuid": "82abb3a1-8603-44fc-96a8-9b6e994d6ef4", "comment": "Malware payload (Gh0stRAT)", "value": "3d1e9a5648c2e25d26b04fb23979c6b566ce027ac5493b0740794b774f9adfd84b86269923abfd958a23586218a541bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521949, "uuid": "a7bf7f7a-a607-4675-9d20-fff7c235dc3a", "value": "T12B85E153F99280F2C748543114AF6736EEB55F854B128B87679CFE1C2C72181BA7B23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521949, "uuid": "f27d232d-7368-47ca-909a-ac0e6d250ac2", "value": "eeac73be37480fd144f387e3563a0f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521949, "uuid": "b14ef322-6e85-4171-937f-2a648e1d6de9", "value": "24576:c89tv9/7JtDElDEExIecl1erdg0MCiVWhR/isd6VRxWXiMd:c89XJt4HIZ/Gg0P+WhIsdtpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521949, "uuid": "68bc7d2c-bc52-4163-94e4-047a8a169140", "value": 1712358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521949, "uuid": "f14255ea-dfc2-4f7a-84a1-16c0c88693d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521949, "uuid": "ca8d1a6d-6c30-4332-996e-3b9a8715aa2a", "value": "727a3d9b0884726b8aa69b6368ec32032c36645c6d82a33ae569d2c94f94f4dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22139bf2-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495071, "uuid": "4b88d4d3-3d7c-4f99-8468-abaccc92b3f6", "comment": "Malware payload (Mirai)", "value": "f2a5ba50da6ebb30b052190099f3647e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495071, "uuid": "4e071958-6315-4591-865c-6a2856dc850d", "comment": "Malware payload (Mirai)", "value": "741f14e16f302aff4ffa2cd1c53dff95f6a4c73b5ad21249612ab049b49b0749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495071, "uuid": "c8b2919a-b04f-4181-b5e8-3fd55cf4916a", "comment": "Malware payload (Mirai)", "value": "a4b1f0a760401b32b2d6cbcfe0ba3c5f919d399b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495071, "uuid": "f8819a92-023c-4e66-8c79-2fad33df85a6", "comment": "Malware payload (Mirai)", "value": "c6b46445cfe751219bc58880b3028089637776c7b766a674d2deaf1dd427d8941c7d7d342f964ed957d65d45b5b66a72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495071, "uuid": "20c1646d-b39c-490a-b79e-632663ae9f60", "value": "T1F6A2E015BF2C82CBC832393495E9F6D21296FC61F2ADCC492540C15BF5A33A96474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495071, "uuid": "bf49a8d9-ee61-4fa9-adde-de0d96cdbb75", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTj:M98o08kxofBE+ZkXaEbp2F2TWul0c5Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495071, "uuid": "2ac6a99a-e97b-4d16-b45a-a8c9a51077b5", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495071, "uuid": "91d02f48-4747-41d6-a002-134dc5847853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495071, "uuid": "11dda9a2-6542-4288-b4df-f73796f370c7", "value": "f2a5ba50da6ebb30b052190099f3647e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a6c70c-1315-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659522050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522050, "uuid": "d699964d-a8da-4944-a7a9-bf717ae212ab", "comment": "Malware payload (RecordBreaker)", "value": "03b9df72ba38d5407906c8f2f58ee482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522050, "uuid": "3860e742-a7d2-4978-99d9-c884e395bd2f", "comment": "Malware payload (RecordBreaker)", "value": "7466d13400fb56153d8204c25eb9305a8e2c49b133a8361161fcdc6fc38eea43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522050, "uuid": "0a40346f-378c-4382-8764-3118f930b0e0", "comment": "Malware payload (RecordBreaker)", "value": "39adb1ceb6d22fc3e20e2a06071580a8c1fe77b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522050, "uuid": "26a9fb66-334e-4fe2-ace5-d968d167fadf", "comment": "Malware payload (RecordBreaker)", "value": "4d296f404acdf11ccaf2fd4d29d95981d780fabffa63ade6235e0d4a491e2f3fd7291294732e87baba4140cdf0420f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522050, "uuid": "557defa4-e011-4319-8656-32587ec7a7ea", "value": "T12233094374919673C190D8BE979922B6AFEFD913E823E2D73F8F23C98D101904929367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522050, "uuid": "62f5e337-4662-42cc-b958-e8b2ef6bb97b", "value": "d24bd3ad7ee896b96a52568978d9c343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522050, "uuid": "f38ad823-feab-46a2-b2a1-4ec219080085", "value": "768:RWwtoXuUHKxI2zN5JjR2yAKJwA2+LVY3z5nNYJNqEzFqhseSex/E9yoOBMM:RtoeUqu2/5AKJwAXmnNYJNZDFAvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522050, "uuid": "c89ab7b2-6c6a-49d2-95aa-0499e5355655", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522050, "uuid": "af7b23a9-4af6-4b77-9ed6-d7441074ef09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522050, "uuid": "e57996f6-f8bd-4e24-b5c9-c79f0d12b1a5", "value": "03b9df72ba38d5407906c8f2f58ee482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144bfc52-1312-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659520388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520388, "uuid": "1650b579-61f9-4fc4-98d6-3ce061f5a792", "comment": "Malware payload (AgentTesla)", "value": "cfa81aac5342e215071ab6138cd55a67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520388, "uuid": "68208450-9ce0-43f4-a272-63618521a19a", "comment": "Malware payload (AgentTesla)", "value": "74f98be038d011db98ffd3403921bbdc2dfe67d8b67c6dc30a401a36f5e1cb8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520388, "uuid": "773a5d89-0329-4ff5-874d-ffc00aef769f", "comment": "Malware payload (AgentTesla)", "value": "f9e52e0663bd10d98381ac0ea7f88c064151b354", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659520388, "uuid": "59e33b54-fa14-4ca5-8bc2-19aef1df8f1a", "comment": "Malware payload (AgentTesla)", "value": "5adcd7c000a4b978aaf6b124ea248a2c99dbe6adb5f3312c89e9446b3693d4862d6c5a85da9fa5b226c44cff26556f0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520388, "uuid": "d372a35f-5b84-4c5a-92d7-eee27e48a075", "value": "T1BDF4129236FA9B13E4791FF1F92041551BB4A23B2922E28D4EDA3DF31435B530B60A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520388, "uuid": "3f5bc900-c92f-4c9a-99c7-856f4f4809bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520388, "uuid": "fde36b20-765e-4dc3-80a1-d1f734349f9b", "value": "12288:Hg6SKlpxo5ZxdtMmlUMZkrS039WbRwxpfH1/070heahF70Eo:JLlpxoVDMmOMOrSpRUdO7SeaDwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659520388, "uuid": "dc8d1828-6886-4701-9745-2caa29a8f150", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659520388, "uuid": "4c7e2cd1-fb6d-4cc2-a446-1d795a8c38f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659520388, "uuid": "03a79ae7-bcce-42dd-aad3-9651375163c0", "value": "TTRANSFER SCANCOPY 099112838377909_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d0d940-12e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659500955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500955, "uuid": "558c0221-4a5b-4d68-91b2-68c24b501cc1", "comment": "Malware payload (SnakeKeylogger)", "value": "dbda9a7f08ab366e7f986ab459d40bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500955, "uuid": "b88f9f51-987b-4631-9f50-0288d32a6516", "comment": "Malware payload (SnakeKeylogger)", "value": "7611436d20a223084b2e2b1f7d2ee7a60d9b029ab0377d9670e427e33d366e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500955, "uuid": "7447369a-33db-4985-89df-284cdcafd508", "comment": "Malware payload (SnakeKeylogger)", "value": "a232ed48656c5c1f83fb1cd58d825bbc421a8454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500955, "uuid": "9c0b03d4-c872-4b31-b3cc-591c2bf44c87", "comment": "Malware payload (SnakeKeylogger)", "value": "8f17b58d9090099cbef4f4b5f1f222bd9cf407fedfc2165b0a76dd6692ea31de03b64d88e3319d82a38d3f880257ab2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500955, "uuid": "554af5a9-a437-4310-9d57-0a005a663a83", "value": "T1E2C49E97A74BEBDEEC5416B80B1E41C51388FC1800755462AF7CDF1FBA5086AEB9C9E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500955, "uuid": "172c5336-8936-458d-9782-368288753546", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500955, "uuid": "35f2ccff-43e0-487d-8663-d0a43c9489c1", "value": "12288:vJAN6Pb3vXIC1hvP7WWaUsXsJ+3PbDB/sHbi7R:RhPb3fIOP7WnzG+TDB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659500955, "uuid": "a29a7a72-77e8-48ba-b819-00e8c29c1404", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659500955, "uuid": "bdd5d5d7-d9b6-4066-9d48-2f84eaf0fa0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500955, "uuid": "ced8204d-3a77-472a-bbb7-d4af1de49f3c", "value": "Shipping Deatials.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d7ae22-1306-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659515615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515615, "uuid": "f23ca02f-a032-4e0d-bea2-b5eb20052860", "comment": "Malware payload (DBatLoader)", "value": "3bebbabe7d62c8cac4f81ad6075a1b98", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515615, "uuid": "20717384-a101-4dd2-8e4d-83cd40026173", "comment": "Malware payload (DBatLoader)", "value": "773a7b6da3993d34fe9593573317031ac5ae7f66ead9d8b0366274094bbe9c5a", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515615, "uuid": "c8a48af4-5e02-478f-b443-0ff6b05855b1", "comment": "Malware payload (DBatLoader)", "value": "36ecddf9dac8b14220b3669c5061c9e747cf798c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515615, "uuid": "145f3846-d91e-43b3-ad86-7041dbbd8ebb", "comment": "Malware payload (DBatLoader)", "value": "486ff8e1433c006263351c93bf0399382ba3f6dc724a038784fdd580c105f48e188259e11a152aab1e826f007b1981e6", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515615, "uuid": "4a58960c-9e16-4890-a8cf-e772bc02b1dc", "value": "T192259D36B2904433D07216789D4B57E8982BBE112E78798B6BEC3D8C5F3B7913925393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515615, "uuid": "4b8c1161-0bc7-44e2-a196-8c33434f5eef", "value": "baa95e98690e6e2028cb267760e931e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515615, "uuid": "c03bee76-f03f-4cc1-8e14-4295a3ad8cf7", "value": "24576:4NZFLUG3u3e+CuySLJj7tGZJqz5d52Ep8rl:4jDVk70UForl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515615, "uuid": "5b4cd34d-5a98-4b2f-bac9-e42fc687a278", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515615, "uuid": "8b27bf4d-e019-4530-86e1-3f6fd50cad7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515615, "uuid": "dd386893-e8d1-431a-93a2-1b0169817f3c", "value": "Purchase-Order737883874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78e4f0b-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537950, "uuid": "951ef937-f68b-4046-9713-42aad34f9e53", "comment": "Malware payload (SnakeKeylogger)", "value": "0195fd10385cbe9d62123149834a5694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537950, "uuid": "2113be69-eef0-46bf-9bf5-0d446da9b35c", "comment": "Malware payload (SnakeKeylogger)", "value": "7749208488cad634ed58d1a6c4606f66a32a5aa246932173528982ae10bb7ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537950, "uuid": "393a7783-9cc0-4879-9e88-6f3c8f4d9114", "comment": "Malware payload (SnakeKeylogger)", "value": "58ce0b3940f29b9be34aa7d5091f4a8bfcc8b88f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537950, "uuid": "03425fd7-eec2-4adf-b433-5026dd6fb532", "comment": "Malware payload (SnakeKeylogger)", "value": "417eb76ca1eb06696eb846dcc35452397be04541eff80f14a18d47bd9af2f4feea70f4ab7dc04aa684f3f3b711833120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537950, "uuid": "2b441e26-8e9a-4cb3-a42a-9e717b42c5b2", "value": "T11FE4128572BA8F1BE0B95FB7BA6180810BF1A07E2053D34C0DCD7CFBA566B531650A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537950, "uuid": "8b3e267a-d77e-47e8-953b-708cd9596143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537950, "uuid": "30f18d21-04bb-4edc-8b3d-9039ef48560d", "value": "12288:9qg6SKlpxnl4xsBlWaeFtrZ2UdhsYVAPfhXM9GF05jaTLxb5Z9+:2Llpxl4qBYaerrZ8YK2o05aTLxb5Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537950, "uuid": "e755ff2a-9209-4d1a-8baa-a3ecfaf6c7e0", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537950, "uuid": "292ca549-bfe9-4364-a34f-7d6d369ff6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537950, "uuid": "c4243863-de8b-4851-9124-79bf5dcb7662", "value": "Item List_Nippon Pigmnet (M) Sdn. Bhd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51204dd1-1326-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659529080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529080, "uuid": "883bb824-77f4-481a-acc5-82c2bfe94e18", "comment": "Malware payload (AgentTesla)", "value": "2809944b7aebc08340da74a7732dd814", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529080, "uuid": "2b0f8dbb-a0fe-4cad-a9df-9c8e417c7c89", "comment": "Malware payload (AgentTesla)", "value": "7762cb14490ef64db5ac4121e403855061b4108cb5f06b10bbf1ea5832ddaf1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529080, "uuid": "df5401a0-e8aa-4a21-a4db-36d8da7c797a", "comment": "Malware payload (AgentTesla)", "value": "a7d76d5ceef164a94312555c9f1aeb87d91ace32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529080, "uuid": "eaae5b98-9e8e-4d56-a4ed-43c1c53829dd", "comment": "Malware payload (AgentTesla)", "value": "77434c36c0860f158dc85d11328584a7a08eb274b25b906f1aa0b90b9ed3fe1347a410997f8981b604df8b8c165d6591", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529080, "uuid": "ff636945-276f-44ac-ac07-9f6bdbc9fa26", "value": "T119F412DA3BBB8B2BD4344BF5F86040850BB0A23F6525E6891DC5BCF3907675B4B61683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529080, "uuid": "bc4220d1-53cb-4192-b6ae-2207b1882535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529080, "uuid": "a377a6cd-8b34-44fb-aa65-e15993c5f01b", "value": "12288:/g6SKlpxjz3zG3F8kP5qA+DlY8tvDyx8RgeiswxA7tSqfJ4QgzCIsg0:RLlpxjGikP5qA4z9mx8Rxw2YdQMbsg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659529080, "uuid": "9952f452-8da7-4ecc-9ef5-c00727a1b7ea", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659529080, "uuid": "ec4145fa-323c-4d45-8128-f68c51e80d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529080, "uuid": "f4062770-1832-4cbc-84b6-5a68e7d75ee6", "value": "BL InvoiceShipping_Document ChinaFOB_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b1688c-1338-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659536925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536925, "uuid": "eed29ee6-2d23-4dab-a3a2-291e630549fb", "comment": "Malware payload (RedLineStealer)", "value": "7aeea205360d07601a4edc23defa5f71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536925, "uuid": "e0815180-1b36-4bdf-b40a-de9d49841a1b", "comment": "Malware payload (RedLineStealer)", "value": "7768d132668a2eb1a86a04b249fab7e5b0790b6a61927ae6db283950f4cc7d59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536925, "uuid": "3261c4d9-4ade-447a-a2ce-be567ef37ff3", "comment": "Malware payload (RedLineStealer)", "value": "02842de7215517f1e4f82e9bafe5a89c8571df85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536925, "uuid": "b30c4dbf-91b2-407f-8365-89009785bf63", "comment": "Malware payload (RedLineStealer)", "value": "b6c817fe6282747fcb1c3cafe8fd49e25506940ca419433ae6bd9eef7d967aa73367ea3c98941a42e3231f7c39229fb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536925, "uuid": "73e3b2ce-75a6-4195-b333-e63e6e9463fe", "value": "T10B345E9C76A075DFC967C576CEA81C64EB6074BB930B9203A06311EDAE0D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536925, "uuid": "8250f76e-4a7b-4fde-ba99-8467041cd59d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536925, "uuid": "ba39a653-02d3-49ea-b7c4-200a59616301", "value": "3072:RfeIqdOyBE600pas/KOqrv6VMiMdvdm1Cg74WAwpMmqP:RfxyOyBPD/+v6Sdvdm1Cg74WAwWmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659536925, "uuid": "1f67e4d3-91c1-461f-9197-215361da11eb", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659536925, "uuid": "c4cda8c4-6f1f-434c-a85f-115488bc097c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536925, "uuid": "a29ca8c8-5811-434d-8854-6e6ba69f886a", "value": "7aeea205360d07601a4edc23defa5f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d81b9e0-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507546, "uuid": "a0379dbc-4ec6-49da-a5c0-633869c5ac9f", "comment": "Malware payload", "value": "5fd78aa58a0e15e5a271eac240b1081d", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507546, "uuid": "50a5bc17-1bee-4d11-a86e-b8a2740bd12d", "comment": "Malware payload", "value": "77b31d33274c8f1c5164eec6090e221e58500674ed6b4ab9355fb96da20dedca", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507546, "uuid": "9179ea78-b22a-4282-a9cb-ea2dd3dd4760", "comment": "Malware payload", "value": "16956188366cfefad2021b29a1967b50f9da9fb0", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507546, "uuid": "b5460a17-2397-4a0b-8922-5dee19a84a97", "comment": "Malware payload", "value": "0690425268c938700e29de84099c251865c951357eefb18ab3957bc53064ff4cfce53f2ca27b8ccb9c74d78a41277848", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507546, "uuid": "9ba98a50-ff75-47e2-b5d0-d9e8ecf7809c", "value": "T10B110E84579CFCFD0E30B395A017CE08B9295A5BA05DEC9273DAC5CE466F5CE030D066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507546, "uuid": "4a9c49a5-2330-4d36-858e-dba330b36990", "value": "24:TriV9Os+BA09veVmouPfio7MDa207p8FIyXxhnLQng7FfheOnyqI:w9Os+JouHRMDs1WhUU53nyqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507546, "uuid": "9223a29e-eef1-4920-8b8d-b419bc40b70c", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507546, "uuid": "46be132b-9270-4fec-ac14-6f7a8f1ad729", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507546, "uuid": "589dce26-c76c-4ff1-b164-2ece0c2e8914", "value": "reverse (2).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fc1db0-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659539261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539261, "uuid": "18b11e6d-7d38-40db-a2ab-71c96fcc6f92", "comment": "Malware payload (GuLoader)", "value": "9f8a61f1cc3e2bbd4e8d37409a12b2a0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539261, "uuid": "fcaf81d4-e936-43a4-a58e-187b1ccb9feb", "comment": "Malware payload (GuLoader)", "value": "78e8267b065cdbf408af63cc1325a2c2f1f006cf83be94ceac1e001ce56eb679", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539261, "uuid": "279049d2-9631-407d-8741-c2027990ebda", "comment": "Malware payload (GuLoader)", "value": "ac637f24bc4bc868b033a66c2fa18fdc99ee056b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539261, "uuid": "652b58f9-574c-47c3-aa65-7489b2b857cd", "comment": "Malware payload (GuLoader)", "value": "1a5ea12b3a08d1d23b58358c4533f822dd0222d54c3ddb47b2a185a25502f4f47090787d94b00ea193dc1a1bd6afb0c4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539261, "uuid": "c236f21f-a3f3-4135-9370-79028ea847d1", "value": "T16764F158BFD0C5E3CB680A308DB6D2BA17B22D631444766B8B40F77E3E77562E509B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539261, "uuid": "15fecd2b-f355-4920-80ed-1896e341b850", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539261, "uuid": "cdb5d084-7cd5-4915-930a-f68f1d2d54ed", "value": "6144:wNeZOqwv/6/iunaHVDEvJBRfI362sLFaFp1Pw/axw5O0O6P:wN1qwv/6/iunEVDEhBRxJFaFp2PO0O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539261, "uuid": "e8748051-5bbb-4d44-bb05-69003d108185", "value": 320064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539261, "uuid": "a12e2e48-99ac-45a0-9112-50cb9885fa62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539261, "uuid": "48701cee-9377-41f5-9af3-63383fd8b5a4", "value": "DHL_229140 documento de recebimento,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089a0388-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659511779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511779, "uuid": "f6c80cee-255b-45fc-aaca-4cd649fe14f4", "comment": "Malware payload (CobaltStrike)", "value": "5f4bddeac9efdb3d9b90f10146bc76ab", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511779, "uuid": "291e03e4-a0aa-4905-9c8b-3c17f5834a6c", "comment": "Malware payload (CobaltStrike)", "value": "7a542cc9772e7433293f2633d019a9f4459ac516a06d5512ba886aeca6c6fa86", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511779, "uuid": "a578685f-025f-45db-9a67-2fea2e8d3e5c", "comment": "Malware payload (CobaltStrike)", "value": "21ba975e62fb149d02f0c085de1bf9e1e7d1a4f9", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511779, "uuid": "e7cea52c-a846-4d0f-99a3-8e26c7825d37", "comment": "Malware payload (CobaltStrike)", "value": "dd4a94fb790b78b04fae6875242272ea3ad298b260df5cccc495c02012011ee189f8579e8183894d6327f790ca7e73cb", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511779, "uuid": "50580a44-5395-42be-abdf-ffa1ce445609", "value": "T116B38D8A236400BAE1534775CDE74E15E772F88273B5424F626882AE5FA37D25E38337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511779, "uuid": "86d8da19-b9fb-4c35-a9ff-9b76f4d1c47d", "value": "38ba784a5f106834fa8e32a8d565f87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511779, "uuid": "7758e8e5-e36a-486c-b8b0-db6b5e90439b", "value": "768:TjlwSvBdpVTmwwXPZFnznvRMrzM5bXjkDLUTqMj1VizMM5gMLNn0FVEvX6FQnZYL:TW2TARFTvRMHUbVrEDyCMVUhZYR8hHk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511779, "uuid": "f383a658-950c-4476-8496-584c419936b2", "value": 112024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511779, "uuid": "5b143406-15d3-4f37-b364-fdaa8862c110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511779, "uuid": "fed31b96-4834-4450-ad45-c06c3f15092f", "value": "c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecdf34f-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537935, "uuid": "945b2d76-8c34-4bc6-a87a-cbc44d5bdff2", "comment": "Malware payload (SnakeKeylogger)", "value": "6023d22c2c472851ea8aa83f950a364b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537935, "uuid": "e4fc4412-18c4-4eb3-b316-944faf217e23", "comment": "Malware payload (SnakeKeylogger)", "value": "7b0b31986cea83552dff0595356e5800c4b82cab9f0117bfa6201aad5f3faf26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537935, "uuid": "890af0ac-50bd-4c5e-871e-70e6660c7947", "comment": "Malware payload (SnakeKeylogger)", "value": "b302fda7126992ccc6aa5a6d38bd49d0dbc4f68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537935, "uuid": "ddcca39a-d9c2-473b-9246-d18eeabda8a2", "comment": "Malware payload (SnakeKeylogger)", "value": "c4ecb25ba07f0eb65365b16eafbf41b2c607443483de8b50997920960f982af3f877e6e59f8d5c6d76c393cc1c983590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537935, "uuid": "5b3fb601-83d3-4071-ae51-4e3b417da768", "value": "T1BB05F13B739BCF13C2654E7ED0C30D9003A7D26E5233D346BAAC3A7769863664982756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537935, "uuid": "76d0a4e8-80cf-48b5-8101-1172e21eb735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537935, "uuid": "7400e813-2269-42c3-beb0-cb25fcf06755", "value": "12288:ACgg6SKlpxWFt+R6lyEv2oSVivJ6kjQR1YZQfpDNIDLc2W5L69yn7cOERgC:BSLlpxNRIyt2J6ksmeeQFQyA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537935, "uuid": "1c2daefd-ac10-476a-b9e3-1b9d87cb3ebd", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537935, "uuid": "40e1752c-8ec8-4eb6-baa5-e294a33c67f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537935, "uuid": "92e2380d-a01a-4989-9b1f-d366d25baf7e", "value": "IMG.005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac68fb15-133c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659538682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538682, "uuid": "184dbab8-31bb-433d-b9e4-b4c808377a0a", "comment": "Malware payload (RemcosRAT)", "value": "8ea6253017bf0ad47a82b7c2962bd585", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538682, "uuid": "791b3da7-7df6-43fe-a5c0-51ad1f844765", "comment": "Malware payload (RemcosRAT)", "value": "7d2277ac2842145d229f31429d8d372c12306363f65cb73b390703f1e0eb95a5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538682, "uuid": "d7db81c0-2c4e-4ee4-84f0-0c807b9cd19b", "comment": "Malware payload (RemcosRAT)", "value": "a7ca2b9293cd4871c2dc7fb4a9bbaaed7bcadb15", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538682, "uuid": "ae4886c8-a429-49da-9103-7ee4b42feb7c", "comment": "Malware payload (RemcosRAT)", "value": "d9d9c5d30417fb4e441aad972f684eeab2f48978701d3944a060d6d877b1c36f9fb34e385285222cc89f92e992af5540", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538682, "uuid": "c62dda5c-74b0-4e8c-a856-3063c8c510bb", "value": "T1E7E26FA2B392DC06D99903764CE7C7D62726FC916F67834B3289F71E1F72A808903657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538682, "uuid": "124ad9c8-4421-4cd6-932f-a1b0d044f089", "value": "768:Ggk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJbPmB/2hvTNtb:tk3hOdsylKlgxopeiBNhZFGzE+cL2kdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659538682, "uuid": "2dbaeacd-a321-49af-a9c4-31e23182e9fd", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659538682, "uuid": "288460e0-0d19-4903-a76b-8f18881f80c5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538682, "uuid": "78a9768e-e7e2-4475-806a-711e14f3b1d1", "value": "ACH_221515_Payment_Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39283582-1355-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659549227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549227, "uuid": "d20a41c6-97a3-41c0-9daa-7169e85c7d26", "comment": "Malware payload (Gozi)", "value": "de00c4750accf516704b8c0df265c24a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549227, "uuid": "a593829c-00fa-45e1-a1b2-d64f512b0b67", "comment": "Malware payload (Gozi)", "value": "7dae6d6fb339b6114ffdd3c0b6bcaa2c9dab0a73979fec029801e9e16d7d06bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549227, "uuid": "e4f13fba-0cc3-419a-9a16-940b27b4824d", "comment": "Malware payload (Gozi)", "value": "eddbc6019ec7ba82d3c5b4c59efe797ff1df9f75", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549227, "uuid": "f15aca33-d1b2-41cf-92fb-eb4767de2928", "comment": "Malware payload (Gozi)", "value": "a67e6dbf096ff5ae945eb92481869a269d38bf6a8eccdac9726f71dd1a75dc20029cd07949df168b3bc0a16c2b24cbd8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549227, "uuid": "a23aa2d8-fba7-4e4f-9813-b2c15d025c4a", "value": "T1BC649E753500BCD6E66E56F7EA5ADDD813726A329D86E8CEA0607FC60463362EF01D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549227, "uuid": "3646b0cf-32a5-4cf4-bf93-72ab811289a2", "value": "6144:9fs+WIrCuJwcIfANlO3MGuH6AiT6nMIMrhfTtOwue9Lign7JEf:xs+TCuqco3buH0T6GrhN7zFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659549227, "uuid": "6e50c2e9-39d1-4f9d-91f2-9bce604befa9", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659549227, "uuid": "874ab328-2a43-4495-8cd8-8ece55c26fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549227, "uuid": "50bde6b4-b6f8-4340-bf24-6f617b805cde", "value": "de00c4750accf516704b8c0df265c24a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceea5cf1-1327-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659529721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529721, "uuid": "4f9365a2-6db0-4a99-b87e-7fe2cee527db", "comment": "Malware payload (GuLoader)", "value": "464579317f30d8af40ea8b3de97e2ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529721, "uuid": "2c09117b-d26b-4f7c-b73f-e57bfc265a9f", "comment": "Malware payload (GuLoader)", "value": "7e469d095c3fa030d8a106a99bd930a01d3f03946cb14e252eb76f3e86d3c60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529721, "uuid": "218a6564-f37c-4dac-859b-456eb2eb6b05", "comment": "Malware payload (GuLoader)", "value": "d9108ee2137524c1963fe4419914beb78ad6358f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529721, "uuid": "bba6df9b-fd5d-47a6-a32a-30b08431b66d", "comment": "Malware payload (GuLoader)", "value": "4d40458631b04b25aac8dda984e01ab8a46c2190ab991c433ab9b1e159c5962eb27d2a493eebf0f69ea17cf9e8f9e737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529721, "uuid": "69baaaeb-156b-46cd-8ebb-b03b4836dd9f", "value": "T12B64F118BA80C6F7CB690A708C76D17B17B66C632444B75B9740F76E2E731B2E90EB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529721, "uuid": "f60ed6e3-b535-474f-b43f-3b985ac986bb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529721, "uuid": "e0ead095-9c85-4899-8b7b-01d5a903cca8", "value": "6144:5NeZOqwv/6/XvCiz/djh/DRfI362sLFaFp1Pw/axw5O0N4:5N1qwv/6/qiz/5BRxJFaFp2PO0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659529721, "uuid": "00a451c9-7ffd-48a4-9dac-487795539b3c", "value": 319960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659529721, "uuid": "4cba99c4-ec6a-484d-a82e-6aab7ad43c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529721, "uuid": "aabd31c6-cbc2-47bc-b376-7315561a8ff0", "value": "ORD\u00da CEANNAIGH- 34002174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46db134d-1372-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659561705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659561705, "uuid": "9c859e46-fde4-48f5-bd18-de62d8d7c2c3", "comment": "Malware payload", "value": "04303ff3eed4f35c9579465372d9c994", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659561705, "uuid": "82145c3f-13b7-48cb-80eb-8b8c6b777101", "comment": "Malware payload", "value": "7e51a43bcb7e287e032a18990873fbb22fa7501edb2f282f7efb6b2fcdc9bdb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659561705, "uuid": "a57312e9-2a7e-498b-9400-2d8cde3d1340", "comment": "Malware payload", "value": "35762dced48751a2285ae27af9aa4614b3e7236e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659561705, "uuid": "cea88aae-7697-4752-bdba-3aef07b2cea7", "comment": "Malware payload", "value": "9aacd2a50f867cbdd36febb9f69fd5ca5cf54745d9dbb9c38b5ffd8a28d4aa1cdbe88794219e1def071892728ef45347", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659561705, "uuid": "e9e0468d-ba9e-4f80-b0f6-0306919c2a02", "value": "T10FF49D1022D96B18E03A9B7456E0D07047F6FD16D639D26D7DE83D8BBB32F408A62763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659561705, "uuid": "2b2746ac-c1fa-419c-bc4c-3e262b16d407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659561705, "uuid": "cdd5bee8-637f-4776-8c5a-fb05f446cbf9", "value": "12288:WXFYBOr182uR7uWiNidO9Z9jJeLIRam4+m7KGNc3oGh5:W1S7Ov97tRh4TPNooo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659561705, "uuid": "e15ba7c7-9864-4219-b417-169456e6e481", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659561705, "uuid": "980e7d65-dbca-4cd9-84fa-ece840effe10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659561705, "uuid": "f9c20dfa-6086-492b-a7dc-658528ef7863", "value": "CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18287ea0-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522542, "uuid": "d240c99b-c6b6-4e71-936e-57aa8db23738", "comment": "Malware payload", "value": "5d131bfaa0188f3d5828258d9fa9f9ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522542, "uuid": "2d06f1ac-7d04-4437-91a4-30668e7fa30f", "comment": "Malware payload", "value": "7ec1d0796cb4163cec686ae4f9c0b0b8e8ae5572cebcea472616e99552042d20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522542, "uuid": "83667c1c-800f-45fe-b692-9d621953fb67", "comment": "Malware payload", "value": "1a6104200abef6d636072014dbd2fa754bef20d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522542, "uuid": "89f204c0-c5ab-4660-a85b-fc272770df5a", "comment": "Malware payload", "value": "137305c5f4d97264258cd3077a942be3e25dc3190d500f8d5baea979d40bb9cbea443d4a877a6705a4cf07360223e690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522542, "uuid": "39ec5609-c612-466f-968e-7b5b01b97e10", "value": "T109F5DFAD6298339CC02E88306133ED45B2B5551F07E489EB75DB9EC06B5F8C5A936F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522542, "uuid": "40f722e4-69f6-4974-a2e1-091a6f9ea00c", "value": "5e4d6ff903bbbbd2b4a3402cd209d7e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522542, "uuid": "6971e989-904d-4bfe-a570-fa042006575f", "value": "49152:+KFda3f5E76YzEMkLiGlxq5SrXtPsNbAjo6s/ZPldT:+Kja2762gewx1rVsiolhPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522542, "uuid": "bfc50ca2-50d8-4c3d-b41f-b54ef3f30a0a", "value": 3561112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522542, "uuid": "921dddec-75a6-4fce-82e5-908ba1517d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522542, "uuid": "d0855015-bc53-45d5-be2c-c7c61a2197d1", "value": "7ec1d0796cb4163cec686ae4f9c0b0b8e8ae5572cebcea472616e99552042d20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bc9874-12fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659510106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510106, "uuid": "8cb04d0c-cb51-4164-b869-9740a9176e6b", "comment": "Malware payload (Formbook)", "value": "98c0b7a8beec5709c64dd1d7a3cd6faf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510106, "uuid": "bb53ada4-eb6b-4da9-b615-f8d616cb51d5", "comment": "Malware payload (Formbook)", "value": "7f1e2ba938fc7bf91ede8cfe8cd83c14b6b82ba6a1c8a0a09acd00d9fa6b913c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510106, "uuid": "1b65dce4-692c-45e0-9455-d349bf666968", "comment": "Malware payload (Formbook)", "value": "494d26adfa05db6773d383b1d85fa3ecc5883b8f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510106, "uuid": "7a52625b-ff6f-48cf-a37a-6c0928310d82", "comment": "Malware payload (Formbook)", "value": "be8c52fe2cc39e60131bc834df296456d3e4e25e96d01f0204e5e5b30d8fcc8823d36d286373cab12712ba4272692c15", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510106, "uuid": "1b32b973-a314-412f-a06b-3667ff8f9d12", "value": "T1BBA533B24048D31F5D4D15D7F9C6ED8FA8F888CDB3406D4E44E0FBE297941E65A3922A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510106, "uuid": "25fd2172-350c-400c-8663-e3300aec3cbf", "value": "49152:Sl5PejDmK1HjyPWkHGADwhtkg9mU6FR3bgw+YA8RR:SjPe9DLyJqkg9mUOLBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659510106, "uuid": "2555d4fc-9b33-42af-a7da-a3169a052551", "value": 2073906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659510106, "uuid": "db898afe-7478-4b45-bcea-e23d685e9ff2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510106, "uuid": "162a5440-b55c-4ad3-9fc2-8713615ed96a", "value": "ZPS- 3668-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e71081-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659539257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539257, "uuid": "4c102dc9-4523-408c-83a3-3e2a5d265b4d", "comment": "Malware payload (AgentTesla)", "value": "16f872b8a8d88b97d3037f2b2f64d493", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539257, "uuid": "f88f29d8-4ef0-42ff-91d9-28f468f4cab3", "comment": "Malware payload (AgentTesla)", "value": "80a2f9deaaac8c62a5a86f6f1290a944701d4da89636985e6c5f1bbf7b1606f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539257, "uuid": "7eff7411-60c5-4f8c-8350-e586c03fc4bb", "comment": "Malware payload (AgentTesla)", "value": "21e5be02780ae7fb36a358770960c08a752f0b96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539257, "uuid": "79229211-4b4d-4fbd-910e-4e981e33e72e", "comment": "Malware payload (AgentTesla)", "value": "5a98179ab36a5d3926c233fd26be04d7e77cdcf7ef6ab813015c718706d5f659226de81762edaa1d49073465b1f8a8e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539257, "uuid": "de548027-5d5c-4c91-8c9c-40263e019f87", "value": "T176F4128567BBCB33E4754EF6F90180510BB5623B55A2E38D1DCA3CF76AB2B4702502A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539257, "uuid": "041bb1dc-4dc9-4aec-9a9b-58f7cc503527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539257, "uuid": "196faa7c-7905-4576-b54b-367b24bfcc74", "value": "12288:ag6SKlpxdOCpPA8OBUmAhVPNOzjUfhQxM3RI0+bS3UdnedKQQAwp:oLlpxnNA8OoPoQr+G37dKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539257, "uuid": "730bf738-a786-4125-b1e0-5edc0c073dff", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539257, "uuid": "4b5da5ef-10eb-4592-9405-85a4cc270d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539257, "uuid": "88b2d51b-76bf-489a-af9d-eed35f40f1ff", "value": "TNT SHIPMENT DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5246df-132a-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659531037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531037, "uuid": "d4d2a4df-eb78-43b2-8ea2-7853fcba239f", "comment": "Malware payload (ArkeiStealer)", "value": "c9948059cdc5e0aef9c193d605c7f659", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531037, "uuid": "36e62434-e98a-4ff9-96a8-a36838061a38", "comment": "Malware payload (ArkeiStealer)", "value": "80f503f4fd7e84b614fc5a50888629178996402d10e245193136c0aee909b87b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531037, "uuid": "96283555-5ac7-4675-8db7-a43ba5397a94", "comment": "Malware payload (ArkeiStealer)", "value": "0c00b2242c86487e305d53aea8894100bda41035", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531037, "uuid": "d651cc66-b9d5-46fc-a017-dd8dec413c86", "comment": "Malware payload (ArkeiStealer)", "value": "a8b5eee4ffc9a6b5d4ec5817dfafd1f9e5b989e2ea11e235e7481ff3772bf1689ca1c0b9edcc118700ce00518656be71", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531037, "uuid": "9340354b-f92e-45d3-9c4b-230536dba251", "value": "T17704BE2137E0CC32D1E7693058B4C6B16A7FBD626BB8998F37A4362E1F617C15A34316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531037, "uuid": "acab87c2-ee0e-49fb-8ff7-a13bcfaf7882", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531037, "uuid": "c2efe806-4ef8-4a8d-8fd3-d8360d8979b6", "value": "3072:O1CItAzXunlpY2Tw4gST76X9JfIruFeKQvd4xlYCjwm3Y:OgSllDwNS/6X9OihQvqb8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659531037, "uuid": "48674c2e-255e-4117-9c49-b8a2bfc894de", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659531037, "uuid": "6ead1233-67ba-4336-b868-3e7d5d57965a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531037, "uuid": "cc9808cb-3b8c-4258-802e-216eba609abc", "value": "c9948059cdc5e0aef9c193d605c7f659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e921aec4-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659537925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "f6eb7502-fe62-440f-9916-66d54f542214", "comment": "Malware payload (Stop)", "value": "654543481e2bc79cae9c7829ed531574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "f21c4f75-b3c0-4844-baa3-9f7c374b3eb7", "comment": "Malware payload (Stop)", "value": "810337996b4f287b6936a21533733fb5427803f255329a73c0e9e81b4c96367c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "d668e363-9bac-4a89-b0d9-1f47240f7541", "comment": "Malware payload (Stop)", "value": "c925aeecdabe483c15dec8483708e7010d68becf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537925, "uuid": "1a32bf45-9114-4197-b419-e07e971bff7f", "comment": "Malware payload (Stop)", "value": "f3f537bf156d59ae5acb4dc50a7769902a8757575ebd0c8da31c5bb6b9cababdb68b58a22593629ab5da2dae967b4ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "930ba011-2bd9-4795-89b8-111070fca824", "value": "T111E412227791C433D5A329709830F7505EBA7662267C998BBF90133E4E75AF06E7930E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "ee4cf6dc-2e59-451b-8db1-94255f009697", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "0a7a7f32-08d8-44fb-bb27-de620aff3aaa", "value": "12288:2AEOF440FXSe883gYd34QXXQEEEH0q5ndvqcEYTD2NC8XZvmXIfLcxas2:2AEU440FieH3gU34miEH0Cdv3hT6NCab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537925, "uuid": "dbfe9ed2-d83a-41f3-bf99-690814e6e95c", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537925, "uuid": "b4dfc2bf-8d2b-4595-ae4a-1fac6db8892e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537925, "uuid": "7f2eefe4-14d7-45d5-8af2-4ef8f40a7beb", "value": "654543481e2bc79cae9c7829ed531574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9390ad1f-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659539070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539070, "uuid": "fac7dae8-5b84-42fd-bcd8-44f26159caf9", "comment": "Malware payload (RemcosRAT)", "value": "a7b8e82c778c1fa74d7ab260b2c6edb0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539070, "uuid": "7179a091-bda3-40ff-8498-c79d3eef0ac2", "comment": "Malware payload (RemcosRAT)", "value": "815dbd7864d3ae2590ff843e598a0847a72b5299bbfddfab5cfd60b20fd17ca3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539070, "uuid": "bf935b9c-096f-404f-991f-87cb14f5ab73", "comment": "Malware payload (RemcosRAT)", "value": "fa22dfcd674bff318ac683f1cf7349c6f86f0e67", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539070, "uuid": "e88d5a13-7f7b-448c-9880-361976408562", "comment": "Malware payload (RemcosRAT)", "value": "263d19a11f037eca63a62d355086c91925e3511c0985560085a76b4b4cea257e20092eee7a18715afa50ca00289abdaa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539070, "uuid": "7ebdc579-9867-45f2-90db-3624f69f5ac7", "value": "T1DF340242BF2A9FB9F3F4EF394454B4D502B0ED013452248ABCA1361F767EE980857B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539070, "uuid": "5de4a531-149d-45e9-a873-f1d224407876", "value": "6144:1FtGJ2nmiv4KzcV4/BwBPUiQvYIG1XUMd+6MI51ZGCBPttzwHM:DVoi/B6PUxv7zGD9rFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539070, "uuid": "7e42fee8-08cc-460f-8305-d6fe9f382063", "value": 246104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539070, "uuid": "8998987b-eea4-40dd-bc69-9ff99bf1490c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539070, "uuid": "b01b7d44-e072-4839-96af-563d56dcf837", "value": "2003988.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9ea40b-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511869, "uuid": "9293c962-f8ab-4505-979b-7fd479c2ffa5", "comment": "Malware payload", "value": "2b125292307de39b8be71d73a8eb2f8f", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511869, "uuid": "613ba175-7a16-4b7c-b2f3-7f19614f6c80", "comment": "Malware payload", "value": "82881470b86dcb38d12ad34c10d5e1339aad98ef7e3bcc1537d78819eaf25229", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511869, "uuid": "550bad99-8884-4e02-a504-aa9a7638244b", "comment": "Malware payload", "value": "87069466a0ba3b567974e296c4f7a053351fd8f4", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511869, "uuid": "db9dce79-2df2-4fa6-93a5-53a478a8624b", "comment": "Malware payload", "value": "fe7558b926dd3a7676150f2f2dd83775ffa8e2d7422848030c6258388ef316f292b1ed92edce237b18e994f36f1bfa8c", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511869, "uuid": "34443e04-50f8-467e-88a3-0d07469c6fc5", "value": "T106721ACAE3888275D9BE0A371CF302414775A5874C5F9A6B388C514A3F2B31393A3B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511869, "uuid": "24d1fa52-ceaf-4f17-a48e-b892022ae15b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511869, "uuid": "a7e934c0-897d-49ab-8037-9e19446fe216", "value": "384:w6QbKrNUlvNDKPa+v49GQmxtlnfR+Q7KSptYcFwVc03K:/QboQclJ+Q7KWtYcFwVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511869, "uuid": "f1c3d950-fdb7-4141-a40d-450f667fdd22", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511869, "uuid": "7b7c9e3a-e1fe-4ddb-a060-d6b1c25e82b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511869, "uuid": "857fd543-033d-4c55-a162-2ab20018a19b", "value": "def.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1441b2-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495118, "uuid": "56c8d8f3-e9db-4421-a731-8a8eb2504a5b", "comment": "Malware payload (Mirai)", "value": "634278fdadc7e370693831be74867e6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495118, "uuid": "9b2c3b35-521f-46e2-9fb0-93df69bdf767", "comment": "Malware payload (Mirai)", "value": "82dd47106c775dfdf97440188b46e24e371ad1b8c2bae9aba001de623c581546", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495118, "uuid": "c8510cfa-d47f-42d0-a8a5-eec37bf95c4d", "comment": "Malware payload (Mirai)", "value": "44e9e90698ee98a49514c2c43121046726f89ae8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495118, "uuid": "8ee44f86-03dd-46da-b3a8-112bbf0cf0bb", "comment": "Malware payload (Mirai)", "value": "2bf2cc8673a81dc45ccad97b3ba1e9c73dbe0cf233ed6fdeda951b277b45a7df7bcd9b452a400929497e53e1ee27e0d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495118, "uuid": "5dd8ce5d-0701-42b9-b421-02b478491f66", "value": "T18E431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495118, "uuid": "f3033e92-62ad-443a-aae5-ce385d587ee5", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwW:RqtmZPuutfbltZFBSJsBcfDSTFI+BEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495118, "uuid": "7f0fe9de-75c2-4321-91b9-50547c71f8ae", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495118, "uuid": "2f4e2924-b7ae-4e2e-afb3-712d7c6e9de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495118, "uuid": "c5775c6f-ef88-4873-8d53-a5082baf6506", "value": "634278fdadc7e370693831be74867e6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50deafaa-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Hive)", "timestamp": 1659507605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507605, "uuid": "58458a91-dd36-4420-a7f3-d5dd8dca182c", "comment": "Malware payload (Hive)", "value": "dbc782e485a365ebc116bd35ecbba036", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507605, "uuid": "f63214a1-d38e-4ebf-b715-ad7a513f4486", "comment": "Malware payload (Hive)", "value": "841e619a0e57780663987feaaac1e623160cd534aa263c563423edcb91cafcc6", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507605, "uuid": "fbe42a73-c0da-4975-b7ac-cf1391f980fa", "comment": "Malware payload (Hive)", "value": "111a9eed09eb3ed1f30d8938ad5dbec1aa1a3f5e", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507605, "uuid": "560f0707-1fe6-4951-8e03-46876620f187", "comment": "Malware payload (Hive)", "value": "f104419fc2db565238851832ae9abb3ce7877d97508b02be0873e9a14fde2db4ae50776e75e1dbcb35bc69e5db554cbb", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507605, "uuid": "dea463db-4f39-4de1-b66f-d21705fd26a9", "value": "T150B57B07BC8460B6C5EA923289B5A2917730BC590F3127D73E50B6BE2E737D45E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507605, "uuid": "b3f0bef7-792e-472e-8a94-7f406da8970b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507605, "uuid": "bf1ea3d2-9cb8-4fea-bbd2-4a9829766061", "value": "49152:gZtKP34rb/T4vO90dL3BmAFd4A64nsfJv0ZgJYzIXFARWID1TIrSmOG1p:g6P33UaR8rGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507605, "uuid": "267c2901-46f9-42cc-a67f-ac8011f11825", "value": 2321920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507605, "uuid": "5247c897-2f57-42df-9bdb-7021137229dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507605, "uuid": "9312260c-26d9-4b5f-8c00-610a0f04a44a", "value": "quietmoth (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918ef96d-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659539067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539067, "uuid": "2bd6f9c9-77ad-4105-8c81-e3d170b798e2", "comment": "Malware payload", "value": "d079a1174a834853e3b5b725cb1ef5ff", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539067, "uuid": "43a58768-c3cb-40bf-b0cb-e1d9ec20aeb7", "comment": "Malware payload", "value": "85711a91cd00bb59dd976c8f95907e66716c9593dba946a5707d39e270abffba", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539067, "uuid": "b7d7fe87-5325-4436-a73f-40976029d46e", "comment": "Malware payload", "value": "225bd7dfa3e15bbc7bfa8f927266d034cd322b56", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539067, "uuid": "f60f66be-575d-454c-aaff-7687de3e04d8", "comment": "Malware payload", "value": "f4124c0365de1d1c9837e70a8abc893c372b2f45cb5779218536116ffd331d2b0b78c4cacf51e863a7f485ed72251fd3", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539067, "uuid": "fc149fdf-65e1-484a-af1d-cb6766932452", "value": "T106E268EC36318D35EFB24AFA94B9DC0B16669DCD1AC1B85C2741330E8AF3A750857A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539067, "uuid": "84a695e8-e33d-495a-beb0-f1884e4f1b88", "value": "768:6W9rrSKDh3XxN3tKCqGu13+R8dLuCympTvKNyWeixMrEyQ8bnV:6sr5Dh3htzu1OKdK0vieCM/Q8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539067, "uuid": "6e01e354-52d4-4cc5-be90-a8fd7a46ab59", "value": 33192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539067, "uuid": "248387de-aad6-42d1-825c-98b1dd096160", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539067, "uuid": "57823f21-f2c0-42a9-848e-4817accfb32e", "value": "Docs & cargo manifest.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d92acfb-1314-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659521451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521451, "uuid": "15d03db9-9ff5-43b2-8725-fd9e1a9d5aba", "comment": "Malware payload (RedLineStealer)", "value": "646395fb07fa2a3705ddd7e51d95b1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521451, "uuid": "0b204fd8-8262-4edd-8748-c40e7bd99fe3", "comment": "Malware payload (RedLineStealer)", "value": "858125b27e9ad1c166c1010c00bcdcd11bc0a974712a6b09c8c3f8858a7061d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521451, "uuid": "b4d3ae5e-50f4-4309-bd90-7c804aac63b3", "comment": "Malware payload (RedLineStealer)", "value": "9beb79c4cb1b5212d555e0e5c2f562bb139ddabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521451, "uuid": "fd231a05-edc4-4949-9a51-34c9bcc9ebda", "comment": "Malware payload (RedLineStealer)", "value": "b44b865eb263d1ac12b96ac3437253fb1e82308595b8ae2bd146478737bbcc260055dac90db51abd7a3f4355231595d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521451, "uuid": "9f10aadb-02fa-417d-8033-772765089375", "value": "T1BC440258CB6CD2B6CF3D373572688A4443D7AEC7B751EA85C715BA0418B77243C3298A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521451, "uuid": "11d4d298-15b2-4d99-b170-a548d48ddec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521451, "uuid": "a96c711c-5ef0-4d43-9e9f-4eba1993e8b4", "value": "6144:aDBkuri/tJaHAOUWnI7MWj1pUAaUHNIuUbSRNu/gpBX1CYO:a1kwMAgOUWIBj1pUOIujEEBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521451, "uuid": "62555a6b-7cd6-4f4a-9957-34ff0fc52c8a", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521451, "uuid": "83aeab61-833f-4942-a738-2a89dbf75971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521451, "uuid": "9f5ddebd-acf7-4148-bf1d-ec1ebb3bed42", "value": "PAYMENT Copy????.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fc24ad-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659542452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542452, "uuid": "3daa9031-5427-4dd1-b29f-2941417dd8c5", "comment": "Malware payload (RedLineStealer)", "value": "39d47435b5d90357e611becb3b49ecb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542452, "uuid": "5e573944-a437-464d-9a19-7ad17165ce75", "comment": "Malware payload (RedLineStealer)", "value": "860e1c103162a30d210ce682981e4d2eb806b810c41f0e85808422386ca6a97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542452, "uuid": "8f82f66b-75f3-4dae-a691-d6ecf8d826a3", "comment": "Malware payload (RedLineStealer)", "value": "ae0d82628088bc9a84a0dc646a8678561945650f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542452, "uuid": "50eb634d-4252-40c1-9906-c7d2552daddd", "comment": "Malware payload (RedLineStealer)", "value": "bd4d74d82e983915bf281c708a14d6aaf9ab62a91b4b721198a8975659a958bc3c4f56e48cbc785c49798b329f181085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542452, "uuid": "621a9642-89fb-42a1-ba02-c44dfbc31654", "value": "T111A58C23F241D43FC02617791D3BAB65693EBBB42A9294477BF41E0D5FB56C0282E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542452, "uuid": "12d8b3fb-3f7a-4648-8f29-2a08af616713", "value": "66af09e6177c53ed790e0c3c461739d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542452, "uuid": "e5ade67a-5394-4312-b1a0-a6c46bd8d038", "value": "24576:5kbul+AAcfmIK0BHS7u8OcnKFImpXu2aGVC3B9mQJ+iKc9k0nfw69IDcYJe1LCyo:H+mbK0JSnepKGITmS86yCsO0xT08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542452, "uuid": "5a20b57c-0c01-4ced-a045-b2897e232106", "value": 2188800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542452, "uuid": "719b78bb-a646-44a1-805d-11f4e595ab95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542452, "uuid": "94f8a1ce-c47f-4df3-a6c1-be33e23d9451", "value": "39d47435b5d90357e611becb3b49ecb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c6369a-130b-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659517644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517644, "uuid": "9ed01e9c-2dbf-44d0-815e-026a0e2824f1", "comment": "Malware payload (AsyncRAT)", "value": "83b8a5df4348dfa60084d51919bd7612", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517644, "uuid": "c4779f1c-e304-4adb-802a-fc8e632fb0e5", "comment": "Malware payload (AsyncRAT)", "value": "8638697480078473d60b20cbeb522b7745dde8ae749159064356b0a31a825e88", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517644, "uuid": "45a9987e-bdaa-4fb0-99d5-83626be6374c", "comment": "Malware payload (AsyncRAT)", "value": "9ca1f23f12e92aa9f79e60a0b67752511a9ee711", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659517644, "uuid": "685b1e9e-ba9b-4c66-af64-288117dd3464", "comment": "Malware payload (AsyncRAT)", "value": "1456bc92a5e442d8a4a593f66ff44d4049b0e08018fb88c1d3f1dc2ce0b7aace028a9d5d58c06bb1a1ca7ee78be66f63", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517644, "uuid": "7a2b0076-c3d1-4b71-98ad-04d762adbfa3", "value": "T1DA232B003BE9812BF2BE4F74A9F22155467BF2673603D64D1CC4519B5B23BC29A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517644, "uuid": "6c2c502c-e9d4-4715-bfc9-368deeb445bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517644, "uuid": "9656d463-f927-4c96-b71d-f8b21d6b5022", "value": "768:SuwCfTg46YbWUn8jjmo2qrZdqd9PIsHjF2m0bMQWd/BMCFx3XQ+pR6XBDZ4x:SuwCfTgp/2L6sHjFGbMQkHjXbR6Rd4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659517644, "uuid": "4003dfa9-5c21-46ef-a5c1-a57e5d1e7e5e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659517644, "uuid": "040fe96f-9a51-4f68-82e0-071f21ce503b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659517644, "uuid": "387b0fa8-3318-402a-8c35-88aeb2fbfe3c", "value": "bDTC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a4464d-1374-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659562855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562855, "uuid": "3696e955-4150-4174-9fa9-56fd8a1af31b", "comment": "Malware payload", "value": "edfc6e2add36e49c8c9e010db0eb0632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562855, "uuid": "d7d576c5-7938-4294-9a78-21e7eb78b2ce", "comment": "Malware payload", "value": "86871dd03f2da6c6de34710060ddc726fae5907f1f48d37c26d23f4d3d3f9bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562855, "uuid": "5d4cb05c-a257-4261-b5b1-b583316290f4", "comment": "Malware payload", "value": "69697675cdc6d2c26db0709339bfd8f42044e7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562855, "uuid": "ff73a240-a86c-4d50-9ee7-3428f1da8136", "comment": "Malware payload", "value": "c1fcd2cef3bdf60f89798522d3b31e8da750408ef2273f7a720755b8ecd142db6e5b7fcee586d05d182ba7d08ff4e265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562855, "uuid": "6e544248-677f-4da1-b50d-cb0410b953dc", "value": "T16B259E32B2904537D17326789C1B67A8982B7D102D78798A6AED7D8C5F3B79038393C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562855, "uuid": "a0e00ded-3810-4c6a-9000-0b5286d21cac", "value": "baa95e98690e6e2028cb267760e931e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562855, "uuid": "b2414900-cf3f-4847-99b1-995aeac98c4d", "value": "24576:4NZFLUG3u3e+CuySLJj7tGZJqz5d52Ep8r7:4jDVk70UFor7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659562855, "uuid": "73f4b5c1-4f72-4ae9-b5b7-74105f9992bc", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659562855, "uuid": "4223540b-a898-4de1-a6fc-daa6314a5e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562855, "uuid": "1740a05f-7fa6-4b1d-a01c-8d43bdc6e798", "value": "INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5395a0a-1323-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659527987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527987, "uuid": "0f2be3db-8f33-43ae-9227-7fa01922c92d", "comment": "Malware payload", "value": "7b6f18b11625e2704f4e404d93437f08", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527987, "uuid": "9fe1ffaa-806c-40aa-9a32-a85cfd18a099", "comment": "Malware payload", "value": "86a619091326ef9f765522bf1548e7dc72fde82b5c0fec854330d35fa0851e9f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527987, "uuid": "dd2a1a2f-c704-4366-a27d-46482ef82d8c", "comment": "Malware payload", "value": "df377271eddb66c1d907ae2563cc4dbd126d6c00", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527987, "uuid": "eb23564a-3156-4370-aef3-8c60c3c6fd9e", "comment": "Malware payload", "value": "be37d2aec2a1e32b69fe2dd1689eee9b1f671a8c85562a4e2a3c010d326b8689e1d0a9f0b858cff13c47883cd0a72935", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527987, "uuid": "65e715f1-6ad6-42bd-928a-667f7379ce87", "value": "T13FD2E19CD216BA4DDDAF987DF80C0EFA4C29618285012C4C3E99E6793B612D4735F1EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527987, "uuid": "ae438826-4f3f-4a8d-9038-58ece95d088b", "value": "768:Yb0KWuHsyS5JgCF0eczcoJ1m9ZGZ2HUYDe6NjMH8zz:YbmsHS5iCGF6GdUAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659527987, "uuid": "715a3d64-3b09-4817-b1e8-6fc66f19b9d1", "value": 30020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659527987, "uuid": "fa0b484f-7b34-4c6d-be24-714e1070df5a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527987, "uuid": "c9994d03-a8b1-4048-9454-e481413d8282", "value": "2_202208329496808197.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc1c696-132f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659533046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533046, "uuid": "85048bd3-b332-4b50-8aae-3d8d2cce2d5e", "comment": "Malware payload (Gozi)", "value": "d4f6b1d3d02e7435f5f7bce955fba883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533046, "uuid": "05711cae-f9c0-4475-a89b-f47cce853cd1", "comment": "Malware payload (Gozi)", "value": "86b1f0e8e8d97005fb1d6671fbd424a8296762c4023f03365d04897b87b75cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533046, "uuid": "c8127a1c-96a6-438f-9d25-38fd58d4b8c5", "comment": "Malware payload (Gozi)", "value": "ef340d5d98842ba2137fb319fcc687412311b1be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533046, "uuid": "57cecd98-d6f2-4ffe-bbfd-3a438fd3204a", "comment": "Malware payload (Gozi)", "value": "fd03956cb5654c29d4ee6f8acb699cde6b6c53672f6b7eb6cf135784b98e608edbadf1ebdd8d304af9f7d4f4c0bb3412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533046, "uuid": "474081eb-dfcb-4f18-b19e-8ff2e1f28b85", "value": "T192345C9AA3E51995ED6BC6B6CD53D227EBF234092B14D30F53B0CA966F17722B11C301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533046, "uuid": "4dff5bc3-2a6c-4684-aa4d-80937414526d", "value": "3072:X5hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vHBB78C752cjUe5e:X+nZ1o+NJWbn2CMFIzSTRDR1vHR5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659533046, "uuid": "cc7a3229-247f-4ec2-aa8c-3cf3d34e6eea", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659533046, "uuid": "5ad403bd-d3dd-47e9-8cf5-35cb6ea74ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533046, "uuid": "6e02635f-0bf7-4943-a8d8-cd129e98c663", "value": "273ed250000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80da8f08-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507686, "uuid": "c9decf7e-d49c-426e-8f10-472784802965", "comment": "Malware payload", "value": "c7b9dc9d444dec4f6d49fff5b0e29a99", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507686, "uuid": "a055025e-59c4-489a-8721-ee8a9f1577fe", "comment": "Malware payload", "value": "8704af833301cfccd31c077a7d926aac968ce288c21b7522bda7f7a5a4a9acc0", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507686, "uuid": "3677a457-f4d8-47b4-bc78-7fa28434b8cc", "comment": "Malware payload", "value": "c79801953f120d56252083e4e27531fb5d382700", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507686, "uuid": "912470c4-334c-4041-bb8a-1e3822d9ecd7", "comment": "Malware payload", "value": "c61a7f52385efa1d1e44b0b56225c9bfe2a39f53c92c4920136387fea5779abe5e775379fc2515f59bba94f3b4456e2d", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507686, "uuid": "bbd62bac-69e5-4772-a04d-4f0c7d1712d3", "value": "T14EF27111B2EACE17F1625A314EE7D2C67635BC199E16C30F32407B2EBC356709E25B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507686, "uuid": "4076c143-b4c9-4078-9d9b-16b1cef39fd4", "value": "384:54l8iSsqdg1vA9er35RBGbKZ0j5jettkka+maBC:5L+1o9ERB1ajnka+maBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507686, "uuid": "fa6d84ba-4690-4634-9945-29b03b90024e", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507686, "uuid": "082a9030-7a7d-4323-a98e-446572753563", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507686, "uuid": "ee90495e-af60-4d82-930a-870e9d835650", "value": "podopitnyu.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e0454e-1386-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659570268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570268, "uuid": "6404b4b3-406b-49d4-a789-e7a6503671b7", "comment": "Malware payload", "value": "d703d943eaf47016796a78b704f41df3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570268, "uuid": "29a547fb-270b-4173-9178-223f2f7e99a6", "comment": "Malware payload", "value": "897eb814baf993c73ac7a8317378312d198336167dac6a67b76bf67d79ca6f4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570268, "uuid": "860688cb-6a52-4e84-a53b-78d058ff43ba", "comment": "Malware payload", "value": "b08cf8ce460349b4d56cb862a2ef7b00f1492fbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570268, "uuid": "9c4be861-38ef-4469-aef0-28f2afd93f54", "comment": "Malware payload", "value": "00c6e6f1c5c2bcdb20c89fac86ac16679216d128d9d9d2ab40eaf8e01a0427be67b1ad38d78deaae2725fca75b7a0028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570268, "uuid": "df51b947-e99c-4aad-8f24-7c3f005c99cd", "value": "T192733A1A78D3C033E8450874C5D186C15FFF9D2376D6946FEFA9068E5AA02D806BABB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570268, "uuid": "b52c2b43-5608-46ed-af5a-8fe48c34ee6a", "value": "62309a495c8c304259f74d2c7a6b9f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570268, "uuid": "2f434648-11b5-489f-9393-352c0f580b29", "value": "768:eAwNCKTBTxbgEq2RJH6Qe3qx5AUjp/bug/9ngYm7zxG7sRq7J/+qL/b+khmbJrwz:eHEmTbNBJHLcU1/bat3Rq/+c/hgK8t+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659570268, "uuid": "5bbd086d-91ec-476f-84e5-d67d39062fad", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659570268, "uuid": "a65f70ff-f8ca-4306-900d-c95fe627b9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570268, "uuid": "3ba0b705-3d59-40f0-92ca-93c374f89b34", "value": "d703d943eaf47016796a78b704f41df3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477ce857-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659539372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539372, "uuid": "c9a1538a-ec9a-4f76-8636-4ad82cef3660", "comment": "Malware payload (RedLineStealer)", "value": "8966cadf9ce71c47e16e88b2736bfc14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539372, "uuid": "3b4cbdaf-cbd5-4533-b3e2-15729b93803f", "comment": "Malware payload (RedLineStealer)", "value": "89b1e820557ff8f83a72c8c522ee69888e51f602ed08bb878d39b24c7c0a7df6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539372, "uuid": "b7ca2a83-3c6b-451b-a9b4-197bbf0e6732", "comment": "Malware payload (RedLineStealer)", "value": "b5fc842419a300540080494b2822b836d8dd31f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539372, "uuid": "a5067edd-5879-422e-90ed-8ecc40f51df9", "comment": "Malware payload (RedLineStealer)", "value": "4761f1bb9971817b552faa123cd26e5271addf5eadae758159f1c76728d2a296e66443b2cb7071a214232edab81a5f56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539372, "uuid": "20fb6e41-c268-4ef3-9b1a-1ef69e608744", "value": "T1C654E121B6B1C472E7B369309B64CAA15B7AB95227B487CF2754063E0F702F07A38757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539372, "uuid": "edeca931-34b7-4caf-8017-01552e344ab2", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539372, "uuid": "f2e793f6-4715-4c2b-a484-c024b7dd9b55", "value": "6144:kZh1dZOSqb1RNUmXitKk56Jl8OWWTn4bMcXG6CbWpDVKC:kL5OSqRlitKk56dn4bNG6cWppK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539372, "uuid": "a69a2f3f-8b29-44d4-8861-c8274b97a1d8", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539372, "uuid": "24efd115-25ac-4c4f-b6f6-f53d38d5921a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539372, "uuid": "accea80b-6ce4-41ef-aa3c-23e6ce08c923", "value": "8966cadf9ce71c47e16e88b2736bfc14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5fe33b-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659513938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513938, "uuid": "f099c55b-4241-43db-87c1-21f35bc39fb6", "comment": "Malware payload (Stop)", "value": "5b55125a6847d4748e66657fdc421af3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513938, "uuid": "3fdabc92-a563-43a6-966e-d41bb1126fd2", "comment": "Malware payload (Stop)", "value": "8cfb0888083949812a02ea8557a86b98969b88c7976a66eae17d493fee7f4436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513938, "uuid": "b776c1a9-9f2f-4102-97cc-be8c1b569019", "comment": "Malware payload (Stop)", "value": "6dda1c2b5d6b3a242754d014930c539d5abb00cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513938, "uuid": "99dfaf19-55a2-400a-9765-f1a3612ae7bd", "comment": "Malware payload (Stop)", "value": "63c90114a0b19bc644bc2c4fd989bab0449f3796b382562d1108687fcf6e383973d43dca02cecbe0b6e99fe207fac8b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513938, "uuid": "db09baa4-e818-45c3-b2cd-634bbeea7261", "value": "T11CE412207AB1C0B6E6B76A318971C6A40A7F7A235B7089FF7754133B5EB52D01D36322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513938, "uuid": "36aba307-2ef2-4ad8-b683-bff065c0c02a", "value": "7b8da7d62de49809359b378ca66a56f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513938, "uuid": "8ed71a70-cee0-4128-af20-5312523d0663", "value": "12288:Q9rtFkHl3K3JjuEY8fyKh2lyrN2MChkrwigAnGxsyVKKKBPTaj/C5L:Q9tFW3MJjpY86p6N2MChEnGxsHKOaup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513938, "uuid": "d60a9ef4-9ee3-4d97-81e6-64909b660e0d", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513938, "uuid": "ad95f9ca-133e-46f4-89a8-53c5fa4a9c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513938, "uuid": "bf9fa652-6474-45f7-ba5d-5ab0bd571029", "value": "5b55125a6847d4748e66657fdc421af3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0598f896-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659511774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511774, "uuid": "1325cb35-26c5-45b1-a55b-d801be0e4e47", "comment": "Malware payload (AgentTesla)", "value": "edd3e948e1195538e80dd8e242e88ea2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511774, "uuid": "25351bdf-b5ca-4e33-a364-dfdf0ce2ac8f", "comment": "Malware payload (AgentTesla)", "value": "8d376c08a62e613b59f43b9be243b71b352d74bb22467be6581a3483d936cc9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511774, "uuid": "98fd69f3-1e4e-4684-98a9-352cafe1a52c", "comment": "Malware payload (AgentTesla)", "value": "5380623e8c9296c9a3e3d7fc10ce0308b3d78441", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511774, "uuid": "b557131c-74ff-4afa-9d67-c081c40243cb", "comment": "Malware payload (AgentTesla)", "value": "168c4877bdabee61caf08b70bc13c46b2fe6957c78fb1902ff60eda01a96f1569f1201238426d7e802f0fe43658d05ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511774, "uuid": "19eb94e8-952b-4dca-ab0f-e7bf6c7c32ab", "value": "T19EA423A6A09DD4CED289127D5F0E0A5FC08EF93F6878CAEBA361D309F4751F19959C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511774, "uuid": "1ad5c1ae-50a4-49e5-8dd1-f3dc39fa4f23", "value": "12288:EvM7rjkQ02iyXuG2YoASmZ6drkFLhojbm:+Mz01iCYfB6OFLOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511774, "uuid": "2d8ec56d-a1a1-4fcc-9f84-64dbc5431324", "value": 490665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511774, "uuid": "7521180e-3d0b-4634-a4f7-2dd7a4cdbeab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511774, "uuid": "4da3ac76-8976-4f21-a3b8-16f4366cdcf2", "value": "SOA for July & August.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c005567a-137a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659565344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565344, "uuid": "317eeddd-240b-444b-aad1-eba67ec50f78", "comment": "Malware payload (Loki)", "value": "48441a21177c27e582c3e46d2f4313c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565344, "uuid": "e8b1d839-0608-46bf-aa0d-5f9ae7469190", "comment": "Malware payload (Loki)", "value": "8e3167b37c0f280ad4736f134b326bc1e75a1f7f5fe0751cc153a08295419db8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565344, "uuid": "7c614e0b-5214-45b6-a8b5-b9c63415b163", "comment": "Malware payload (Loki)", "value": "9eb6b49ff3d2fe62ba86eb2c3765db0cd6a0a727", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565344, "uuid": "1d5d84a2-4879-4820-b17c-13a0574c62dc", "comment": "Malware payload (Loki)", "value": "587cacf7d633008b17824b11a483629358f549e9c6ccaf9a11e0b54e74e26a6fcaf97e52a6788da08cf0138f8db1452f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565344, "uuid": "25c7ed48-36f5-48a2-8900-0de592f21d02", "value": "T180C402A2623CAF62C6BF47BF80A04145C7B8B21BE0A3D3DD5E4872E92D177555A0173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565344, "uuid": "0c9dc6df-2284-4df8-9541-86003a9f284b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565344, "uuid": "da3562f6-11b3-4723-a481-0890a8c5bd27", "value": "12288:SbMiR6SIFdlfSzorOlTXdog0iytr9dJ7mUqQafNSnj+csx8:SbM66HFdNSp7RAx5qP3Q/sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565344, "uuid": "871d2b80-1555-44bc-9d62-73a304806c75", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565344, "uuid": "f8d4da6a-f496-4edc-9e9d-55d69d2b2011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565344, "uuid": "fd9de4c0-c25b-496f-b6d2-1445d2f23741", "value": "48441a21177c27e582c3e46d2f4313c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93740103-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659512871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512871, "uuid": "bb86cb55-3d04-4057-9d77-15b43ebe5e1f", "comment": "Malware payload (AgentTesla)", "value": "4aee6dcdc75dbd28f6daa5ac83ac947d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512871, "uuid": "8c242cb5-7a41-4027-8951-141c37ddb5ba", "comment": "Malware payload (AgentTesla)", "value": "905dcd26038c83f0df03e9e2db563cdeec5a4cdf4aad7c5b507bf3c84371e225", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512871, "uuid": "e5cc6482-5bf5-4fce-96c7-8eb7b8633770", "comment": "Malware payload (AgentTesla)", "value": "55f81059ab42eb1f7d31f7fd300cd27b75e5baa6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512871, "uuid": "bfefdc8a-21f4-4ca1-990c-5e3e457a3183", "comment": "Malware payload (AgentTesla)", "value": "ec31d1d7a7fd8042fe888b511578a933783e6bbc378d977e127a4709122913e73d3313d3c25ac3c1cca05df0738d6361", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512871, "uuid": "f2ca3f0c-1efa-406c-b7cc-47bc89937292", "value": "T19BA423A6A09DD4CED289227D5F0E0A5FC08EF93F6878CAEBA361D209F4751F19959C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512871, "uuid": "4005ae0b-c468-417e-b7bb-71e905d38850", "value": "12288:/vM7rjkQ02iyXuG2YoASmZ6drkFLhojb3:nMz01iCYfB6OFLO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512871, "uuid": "e0c97f21-4e8c-4157-9381-1ce97d426b42", "value": 490653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512871, "uuid": "3294cad7-7a61-4b89-ab72-a9a92a5158e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512871, "uuid": "21e2a327-4af5-4d9d-8028-28d4e530a4da", "value": "QNLNSAHMD2202897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefde6e2-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659557719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557719, "uuid": "736ef807-f1a4-441e-a5d1-d81754316ebf", "comment": "Malware payload (Stop)", "value": "65bfc46d761e9a11607716d25cbf0ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557719, "uuid": "4e861471-6974-4f84-acc3-8dc6fb6a0436", "comment": "Malware payload (Stop)", "value": "912f5bf48f09ed43a89f661ad75e3a84dde13b1a32f4398cdb280f9af56abffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557719, "uuid": "62e5e751-0ef5-4024-92ce-faaf44f2d0d1", "comment": "Malware payload (Stop)", "value": "cd9be04099932b94208c46301d882f8f5bf1cf3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557719, "uuid": "68a96d75-830d-4aae-ad01-6c06119e441b", "comment": "Malware payload (Stop)", "value": "c9bced96d1b3f090181e2d7375e46c043b20edd8f0eff0ccc00d8c8faa658d816cffb75eefc5fc098024b4ca7736192f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557719, "uuid": "7750fa12-d03b-4840-899e-3f6b5d5bd1f8", "value": "T1BFE41230B6B3D4F2F4A36A3414389A905AFA7E125675198FE7901B3B9F252C2793D307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557719, "uuid": "21f7c228-4904-4e4d-8063-08e4c2d6eee6", "value": "ba3d499d4d95678ffdd9252ddd2d1d74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557719, "uuid": "c3c78aa6-aae2-44b4-9eda-4790a8cd734a", "value": "12288:LeKKVwtfkntAqrReepaGPdGD8Gu1GVdpD9BF3627KrPmoSFgQzC2bXd1ztm8m/8Q:LehS9UtXReepaGgD+ML9BF3h2reDFgWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557719, "uuid": "865485a3-928f-4a41-b894-5d7c4b71cf7a", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557719, "uuid": "7277c79b-1df3-412a-91d8-8af70f9aadfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557719, "uuid": "2414963a-9fce-4b9d-8d4f-016027a76559", "value": "65bfc46d761e9a11607716d25cbf0ccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139ccb02-136b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659558612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558612, "uuid": "c612da1b-f318-4a80-b7a8-2347f67ce840", "comment": "Malware payload", "value": "cf8cbbb686d778b9a4118a67d53a4742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558612, "uuid": "ea0cfe85-8537-473b-abf2-fb7cd4e8c256", "comment": "Malware payload", "value": "923719834c66427ec96deefc9729cc4eeed61e730dcde33fccd587e21eadf381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558612, "uuid": "e41e5ed0-88b7-412a-a55d-f0cc2b78f95a", "comment": "Malware payload", "value": "3c06fdd8f68d9eaab136aac3b2d42c24eacb6487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558612, "uuid": "e3b2f947-bc9a-434b-8aca-f4eaa7bb0b22", "comment": "Malware payload", "value": "c1f414a7bddf80bdf097c35186709ce2a883810e1d3d6b99dbb9d6f0e3c5626d1ec38d21896e8d3f31b204f57ee09a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558612, "uuid": "23885036-d691-42c4-b90a-13b0e7d610a8", "value": "T15063E79C775079CFCC5BCE72AAA81C28AA20B477571BC243E05356AD9A0D68BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558612, "uuid": "726fa707-6297-458a-b014-e8617edafbff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558612, "uuid": "d24269bb-fa8a-43f6-b118-07e923b54f96", "value": "768:9ILptt2Q1JyfhPM4vWCz0sBe01ucDNn2HTEtlrbca4sKgZ1h:Cth1M1lWCzb401dnKTm9bc3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659558612, "uuid": "6439c47d-834b-454d-ab2e-4d7faf05d590", "value": 68128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659558612, "uuid": "a54b571d-ee89-4489-b13e-9b3b2b6d899a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558612, "uuid": "9d26a77f-dbe9-40f3-ad7c-72dfd2ba6aa6", "value": "Quotation and Catalog .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4650d6f3-136b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659558698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558698, "uuid": "b73f72de-eca2-428c-96a3-66ed86110283", "comment": "Malware payload", "value": "e889cd39da3e9f962667476c76d6bae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558698, "uuid": "3a66a0ea-ddcc-449c-af96-8cd9a7d852a8", "comment": "Malware payload", "value": "92d256d51b6838c1a79f0b092c962c54587f6e8e0879676d9f8e225557c1ef9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558698, "uuid": "7c6e4997-5be5-431a-839f-5ff00ea20eb4", "comment": "Malware payload", "value": "4c5cb7af82e2898b881476b011bab031404ee48b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558698, "uuid": "f4e56ba4-dc78-4077-bd80-0a6daf64e4b1", "comment": "Malware payload", "value": "ac846f6bf684286773ba9e9cca387533d061d9716c9c34cc3769d78f06440ad0fa50cfd566c6252efb049277c9f9e8d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558698, "uuid": "56635008-251d-491f-a13b-c7ef480b7c45", "value": "T12625AF32B2D04837D072167C9C1B52E5692B7E102935A98A7BED3D8C9F3B79138293D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558698, "uuid": "0c31a4cf-79ab-4afa-b5e2-cf126b0775a9", "value": "baa95e98690e6e2028cb267760e931e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558698, "uuid": "174d3562-99af-4579-8100-fd5c2284c4e0", "value": "24576:4NZFLUG3u3e+CuySLJj7tGZJqz5d52Ep8rW:4jDVk70UForW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659558698, "uuid": "f903d83e-34ff-479c-9ea9-525313bd221f", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659558698, "uuid": "b9109323-fc7a-4aa8-92d5-623ba72529e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558698, "uuid": "d33b5d4b-fbb5-427d-a125-0b14684c1c1b", "value": "CNY-Payment Receipt-XXXXX2822_HRUGL1_R1110163-020820221620071907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07d83a7-12c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1659488841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488841, "uuid": "5d685f88-d498-4b79-b7a2-08a442be1a76", "comment": "Malware payload (njrat)", "value": "0607fd9be8493919cc4ff70130cfcb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488841, "uuid": "4b5656b9-ba47-458e-9b73-955fa65524d8", "comment": "Malware payload (njrat)", "value": "94035bc4205d2c7a1d3a8890e7c68bcd73213b0871523b4c773cbc9bedea05b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488841, "uuid": "a6218967-a23c-424e-8cfc-2b08b408ff32", "comment": "Malware payload (njrat)", "value": "a4c89d60bf22c59951a7d1ff2d5c60ab8ef68fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488841, "uuid": "397e4a8c-cf6a-4aa8-8cd2-be703e397c67", "comment": "Malware payload (njrat)", "value": "2ab2b854f12dd4157999f29de7e0276e5c80fdfca27470e3185cf615d5d5051de14fd0300f981cf0fcc0e9ad32fd996e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488841, "uuid": "c5759e11-0e4f-40de-91a7-53d02a3c7bc1", "value": "T15CF2F75937F28222C5EE17726962D32312F1E2136522E71E0CE4B8EA7B33AC50749DF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488841, "uuid": "c07b5f2f-40d2-454d-ac38-a9a7fb4bea50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488841, "uuid": "92ef22c5-22f5-49fa-9c7a-7a44c53ae04b", "value": "384:UUZH3SDrzLNrVOvPKMLt2vl84e+mzPLTCn2Ie2Ue/tHhotLtIanrEp0X:PHCDrzpmCMxc84TTUFhneI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659488841, "uuid": "1928668d-4a85-4885-9cd5-1ce6a2c0d9b8", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659488841, "uuid": "176c3e90-7432-410e-be74-4391b833df45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488841, "uuid": "8ffd1fc7-45a7-4726-bd95-ab23774daff2", "value": "bDTe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24755532-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542749, "uuid": "d866841e-9c75-426e-b9f1-edb3ac3c3b31", "comment": "Malware payload (Mirai)", "value": "1577ea5561b8d5c7cda4f90dbf43c526", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542749, "uuid": "a86b3ade-a9e6-44d2-8e70-327694077ef7", "comment": "Malware payload (Mirai)", "value": "95e56fd28e9a2519ebecfc91af025fc4eba6806ca885232ac2843e2a9f3a27d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542749, "uuid": "a4067361-6bbd-4748-9dee-9e13ae41fd75", "comment": "Malware payload (Mirai)", "value": "50d1292abfbdaa3310238325e88dd227a7fdda6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542749, "uuid": "baf85a9c-3070-4b14-bbee-4694e11a9067", "comment": "Malware payload (Mirai)", "value": "0ea05444d4356ec881a84b18bc02069cf182280e498e68a8b07df0ab90b7d8227724dbb393a64e49b2f587eae3bb73b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542749, "uuid": "f1860b5c-70d9-4acc-bafd-1bcd5e692d43", "value": "T13D432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542749, "uuid": "9c217a62-00c1-4080-b103-31942ff1b30d", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwT:RqtmZPuutfbltZFBSJsBcfDSTFI+BET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542749, "uuid": "f1e32128-5d09-4b7a-9594-8c55a5102c21", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542749, "uuid": "e1f6bcfa-6c23-4f9a-8e28-ac6327196eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542749, "uuid": "423b6bfa-bf92-4008-8f9e-f415fe3e6819", "value": "1577ea5561b8d5c7cda4f90dbf43c526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbeafb2-1307-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659515733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515733, "uuid": "df44dfa8-4402-4af5-a445-a548d28da801", "comment": "Malware payload", "value": "d99db2ce130179a1f2695b5caef5d07f", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515733, "uuid": "2e69ad94-0037-47b2-9ba0-3fa5efeb2cc6", "comment": "Malware payload", "value": "960d36602d6705c9adc1b01920d3b899f01e24a07077a055a0476577ef4db999", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515733, "uuid": "9fe5dfd4-f31f-4abb-a6f5-f981b06d8112", "comment": "Malware payload", "value": "559439d9784f5cd6da9cd49e30a93ff38fdaf9db", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515733, "uuid": "9569e338-ee34-4796-9cd2-fc5db6275ad2", "comment": "Malware payload", "value": "5d1f318ddcf7255d1776ae556d7737f90e8cb6a4ebdf7e4421c4f23af7bab96a3f9dd7c4204e00bbcb843a6c17d6d5d8", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515733, "uuid": "71e299a4-18aa-4f51-86a9-7404d91acc5c", "value": "T12ED423EE052335C874BAC66551450EFF988F02E751BB79A08019FE9C39B96678B7E303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515733, "uuid": "3ab0e2fa-319e-406f-9b02-d3345000e0d9", "value": "12288:aM5J+tXm2oyGK8mmygG9lhxUKh7UZ8XQLd0Fmrsh2ZRINWs:dqXm2pl8mmygGTw0mYh6Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515733, "uuid": "f66d0406-0f00-4206-b76b-24d015e3ae6d", "value": 636575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515733, "uuid": "e4460f59-8a18-4793-a416-7565d8ddecb9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515733, "uuid": "bee137e1-9e6f-4b9a-a82a-10ba00dea1f7", "value": "SHIPPING DOCUMENTS pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d04521-12d7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659495109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495109, "uuid": "9b0f0755-c7bd-4e6f-aa1e-7635c9cdff2a", "comment": "Malware payload (Mirai)", "value": "0fcf9cbccfdc185d6ac4c4247f2a9844", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495109, "uuid": "8082cc1a-15b5-459d-b783-1f54d291589a", "comment": "Malware payload (Mirai)", "value": "966eddfaff3154190a0cc17b7b87c3a66d70d44e1213c1b5be8bd363a48b8d63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495109, "uuid": "29ade483-e6fa-44b6-87bc-d789072c93dc", "comment": "Malware payload (Mirai)", "value": "2d363b6e0872fe80a29d086f2312fc3a268af68a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659495109, "uuid": "81ca62e4-38d1-4b50-8af5-bbe3843e3bb1", "comment": "Malware payload (Mirai)", "value": "efd596a2919dc7a9fe917948d495debdc528d5c3aed3b11d4c2900ba0150c3da3436af2383a6df6fbbd1fad79a678485", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495109, "uuid": "b7f94f50-cea4-447b-be57-9d1556b674bd", "value": "T13B82CF3051AB74F5CBE10431FAAECEC6971A0BBCD1FC36D217596B78894610615F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495109, "uuid": "1325815c-c4c2-45da-80a1-b16648cbae61", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa3dzhymdGUop5h5lP:2dV0P6+kom0tVAoNvm+to13ls3UoznlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659495109, "uuid": "6b2edd06-076d-47c8-ac84-0fe4ff78a8ac", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659495109, "uuid": "44133424-8604-4b35-bd0b-b157fcc3f569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659495109, "uuid": "8eddc817-c38e-435a-88bf-2a261be7dd92", "value": "0fcf9cbccfdc185d6ac4c4247f2a9844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3492d2-1305-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1659514848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514848, "uuid": "82782fd3-c177-4aa8-9004-b3ff09f1ecbd", "comment": "Malware payload (DCRat)", "value": "4f64c5ba875a44be67619fa8342bc777", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514848, "uuid": "2fb9629e-88be-4b98-89c3-87539b5bbebe", "comment": "Malware payload (DCRat)", "value": "96ddb4fa1a296cccac8a22faa8773f1343e2ced466b478980d64f1af493c103a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514848, "uuid": "d6e936cb-918e-4a74-8525-f737f51ac95c", "comment": "Malware payload (DCRat)", "value": "c192a53b53940892febe4bdba9adf9c940988d0f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514848, "uuid": "1ee0c0f3-6660-4ebf-9369-ca116807d20d", "comment": "Malware payload (DCRat)", "value": "b76e09f4d66d3d07afc6a4e21f12d0c1bbcf0f421b97a529427f83dacfe9cb22cb29243a1a8baade584e41097d21d4a3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514848, "uuid": "c20bb83d-e9b2-4ff4-951f-1c6e820b941a", "value": "T15895BE027E448E22F4191633C7FF456847B4AD112AA6E32B7EB9376D55223937D0CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514848, "uuid": "97ef2975-3869-4342-b57f-44f31e398062", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514848, "uuid": "7fc531c2-4472-4af8-9f39-225028928322", "value": "24576:U2G/nvxW3Ww0tQT4rFGyMLF7M214XwJAdZ/tA6aHRj7oD9MpkYNDNvNmNQB/YQLE:UbA30+SFNk3rAf/O9d0DLawQT8qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514848, "uuid": "6f1c1f31-fde0-4dd5-b59a-cd1966fd7c9e", "value": 2048823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514848, "uuid": "141ccf72-be57-4a78-bf96-dbc5f43e3d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514848, "uuid": "74f7d095-9501-41d8-aaa8-2d1b0ba38459", "value": "96ddb4fa1a296cccac8a22faa8773f1343e2ced466b47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b07afa-1386-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659570286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570286, "uuid": "1721f250-3a3d-42fb-897e-d395f768e040", "comment": "Malware payload", "value": "2549abd9cb238b20f68d380629ab4bf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570286, "uuid": "f9e21fc3-9bce-4a57-aecb-5b6d5a3e2eb7", "comment": "Malware payload", "value": "976f6358c219bf266b568bf366ed826f3eb9efaa8520444ee444e1dcb4399e8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570286, "uuid": "70b2feea-24fe-4997-a4c5-0dd29ebcdb04", "comment": "Malware payload", "value": "af0b8b625b44159d2258a92288438112f58337b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570286, "uuid": "b16cdcac-6aba-4161-903f-c8fe4788a562", "comment": "Malware payload", "value": "cc9d297c3a52b111c5196cc3513b5da3b18bf1407ae3a5dcd16e19df4b15183e61547cb1f8b363571b58a46ed80bca5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570286, "uuid": "c17697f8-c02b-4677-b361-bb9642586187", "value": "T18F733A1A78D3C033E8450874C5D186C15FFF9D2376D6946FEFA9068E5AA02D8067ABB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570286, "uuid": "eaceb68b-f1a7-4356-9e06-29f0369f62f7", "value": "62309a495c8c304259f74d2c7a6b9f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570286, "uuid": "a1e32e51-3d5c-40c3-9b82-da62ac215651", "value": "768:eAwNCKTBTxbgEq2RJH6Qe3qx5AUjp/bug/9ngYm7zxG7sRq7J/+qL/b+khmbJrwZ:eHEmTbNBJHLcU1/bat3Rq/+c/hgK8t+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659570286, "uuid": "3aba9f66-1930-43b0-a34d-5d4f51a12b2c", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659570286, "uuid": "4bd7deb7-16d1-46d3-904e-7e3b1697a3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570286, "uuid": "54740024-641e-4b66-86ef-2041e3e06962", "value": "2549abd9cb238b20f68d380629ab4bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d1af12-1342-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1659540975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540975, "uuid": "0dbe485b-4640-484b-bfe0-7834f4593afb", "comment": "Malware payload (ModiLoader)", "value": "aea0bc608b434a27bd12ec5520f12c89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540975, "uuid": "86920a33-1d58-49db-bc7e-ecb5032ffe1f", "comment": "Malware payload (ModiLoader)", "value": "97e97eb7101472750099ba0404381a34952bcb0114e91a63c7ad241510691cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540975, "uuid": "fa7183b3-4c64-4dbb-b0aa-2c31bba04bdb", "comment": "Malware payload (ModiLoader)", "value": "0779f1b1918c04a25d006fc2f94979d7a240fd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540975, "uuid": "789c2710-0d2a-47cb-9345-85694d7df4b5", "comment": "Malware payload (ModiLoader)", "value": "ee64be322b59373744eff63b2c5e85d49f72896dcdc05540b48b78abfa77c930a9be0028b91f70f5eb6ddd5627377bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540975, "uuid": "518e9963-a248-4b2c-a8d5-d7feb8fcc19e", "value": "T15C259F72B2D14937D17326789C1B52A4992BBD003E78A98A6BED3D4C5F377803839397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540975, "uuid": "829ae6cd-0dbb-4852-a659-b8bf8a802367", "value": "baa95e98690e6e2028cb267760e931e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540975, "uuid": "5dd66ccc-c2eb-450e-8646-b318484948b5", "value": "24576:4NZFLUG3u3e+CuySLJj7tGZJqz5d52Ep8ru:4jDVk70UForu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659540975, "uuid": "d8a12b0a-34e0-47da-8427-2b1e681aa6aa", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659540975, "uuid": "49c8ffef-cb5b-4783-baa2-f39055e54a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540975, "uuid": "409b201e-eb5c-4caf-9fdb-bebd65bde37e", "value": "newfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba438a65-130e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659518949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518949, "uuid": "151ea215-f7e0-4fa1-bd4f-08c9c84b1c75", "comment": "Malware payload (Gozi)", "value": "614e312af0e5de7c6b9819e3a1c766d4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518949, "uuid": "bef748bf-9110-4d0d-a09f-91ba0d2c1eb8", "comment": "Malware payload (Gozi)", "value": "982ff4dcc3dc076b3c40f5cd5993d05f7578dd83b631146105b3840864c76203", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518949, "uuid": "11734669-0881-415f-9961-0a042070bd2a", "comment": "Malware payload (Gozi)", "value": "01e384618d8eadb244184e66e6450752ea0ceade", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518949, "uuid": "388824cf-7565-4d7f-8797-576a462374e8", "comment": "Malware payload (Gozi)", "value": "600f7b662533a2f1d032ec33c54d3339e009e2d65fb54726560838bcff7dcd7bb33df3f42baaba35c6e5f8f5ea1f0b84", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518949, "uuid": "dbc940cb-ab62-42a0-9136-adf0e197dbda", "value": "T198649E757500BCD6E66E56F7EA5ADDD8137266329D86D8CEA0607FC604A3362EF02C03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518949, "uuid": "84b5ad90-4625-42de-90fe-bd3287f8061e", "value": "6144:Mfs+WIrCuFwcIfANlO3MGuH6AiT6nMIMrhfTtOwue9Lign7JEf:Us+TCuuco3buH0T6GrhN7zFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659518949, "uuid": "591d4a5e-bd82-4fa8-8f27-8022037e2eac", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659518949, "uuid": "397ebecd-e769-4e27-bd6b-e4cd0ac911ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518949, "uuid": "e726df70-7eda-4f8d-8a2b-26ac519195be", "value": "62ea3f935563b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea5d28e-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542766, "uuid": "d5e18a8c-f393-4d76-8264-ab241f3ed93a", "comment": "Malware payload (Mirai)", "value": "e12642d4f1907aedf859474bf971498f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542766, "uuid": "7cb11e08-c4f0-427f-9b68-90817caa6c9b", "comment": "Malware payload (Mirai)", "value": "990ecd83bb3c52943b8a6413b3cdc75a62e7cf23fac09bdd56d71fa7d642732b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542766, "uuid": "e1d2e4b1-bba1-405d-aa46-a7db88183443", "comment": "Malware payload (Mirai)", "value": "1c2805bfd6ec0c685adf89452e22e1bde471cc3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542766, "uuid": "468eae31-3bd5-4c2d-a460-480ef5a94e59", "comment": "Malware payload (Mirai)", "value": "0cba408dfa974bfd0ada93f585150729eb43b7960d76a1b666d2e30d5d9756d53f9108ab0e1e996cd64d441212c69c7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542766, "uuid": "a8f73c65-215e-43d4-b83a-839df643eadb", "value": "T14AB39DDBF2470260C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542766, "uuid": "e29529ab-66d6-4c9e-95cb-4c73427f0cf8", "value": "1536:xu27gBY25SSpHP9pEFwiLShWnwg1O/LWK:Y9zSyv9HiLShWwg1Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542766, "uuid": "0a10cb5d-8d2f-4edc-926c-7e8d608753c5", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542766, "uuid": "168d0ec7-24fc-4c3e-bec5-931a245214c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542766, "uuid": "2003eea5-30e0-4b8e-8256-141a27b83e31", "value": "e12642d4f1907aedf859474bf971498f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c5260b-1315-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1659521733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521733, "uuid": "399b4308-31df-4dda-87c6-6ce9253eff28", "comment": "Malware payload (Gh0stRAT)", "value": "090eb35c39decacb4bdc3df1d74c5c56", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521733, "uuid": "74c5c883-94b9-4c70-b7a3-e1724a0edfd9", "comment": "Malware payload (Gh0stRAT)", "value": "999e537d3fe2789a074121cee8f83d6858ca7d0baf7b54e6e24ed5f91a231444", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521733, "uuid": "9d47216b-12bb-4148-9c5a-3ad339ef206e", "comment": "Malware payload (Gh0stRAT)", "value": "a3fafdee3dac8f897643073dc44f3e7132e552da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659521733, "uuid": "74222830-3092-400b-9f98-f27e34b0b321", "comment": "Malware payload (Gh0stRAT)", "value": "69cf1405ca4cf04f667785623272b6c9da80ecd53f4384ad4f488582fdeb627cd9ee502bd3f0e634405f77999074ba52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521733, "uuid": "6996160c-2775-488f-b286-37696064e725", "value": "T1D736237363E60146E1D58C36892BBDE131B2036E5B42FC7D65D278C230665B4F782EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521733, "uuid": "1d90e087-66d0-4e8c-b812-a081a1bc8e6e", "value": "e3ab95939acedecdbcfb72ebffe42360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521733, "uuid": "835efb12-c8ea-4d68-a391-c41adb93ebab", "value": "98304:ptRaDI0ZNuy/modlaY4cfLZot86VTW6jVtYvbGUDTdt1vf3UL6a4XEmF8Zs6:ADlA1maY4cTZU8aUDH5f3UL6a4XEmFH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659521733, "uuid": "4c805df5-fac6-4f9f-aa32-e914905e5436", "value": 5042712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659521733, "uuid": "03ec3dc2-4dae-4e7b-a00b-f2d8ee91eb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659521733, "uuid": "66627385-2d89-4d5f-b5e2-fb7d16291dcc", "value": "999e537d3fe2789a074121cee8f83d6858ca7d0baf7b54e6e24ed5f91a231444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544ede20-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659539394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539394, "uuid": "c3cce3fb-2e0c-4d11-b63a-2b2ff3687a81", "comment": "Malware payload (Formbook)", "value": "86035f0bc9b0cd47460bea0fd880b5d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539394, "uuid": "ffd076a6-d01b-4ad3-b1bf-867ebfad3053", "comment": "Malware payload (Formbook)", "value": "99c654a8da97097233441ff833bbc52de2c9e3107e0f50075c7dda8ad111abfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539394, "uuid": "8550689e-8cbe-4c7d-b1e2-3d97ef55f45f", "comment": "Malware payload (Formbook)", "value": "4adbec7576877ff885ef474c98470200c17f21ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539394, "uuid": "41481759-c744-42ad-8a02-03d9ccd12929", "comment": "Malware payload (Formbook)", "value": "08ddf02b5ebab67f8df222e3967ffb145851d11556c6f79cc88e060e80c1e525300841e34c0b2d8222a87ea614b16022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539394, "uuid": "21b754c3-666a-4cd4-9f7a-889395feff3e", "value": "T1F1D4F109B150ABC0F8C9AE32452EAA4DB5D22E361F7C584694893773217FFC29C6674F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539394, "uuid": "2c75f54c-1cf2-4c51-93d3-53dcd06a9043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539394, "uuid": "968c5ddd-961c-4402-bfc3-82cca97b857e", "value": "12288:KwTcUoeYpkNN3tFvDvEY3x3E2pzDCYvoxjWYu3Ylx:B3oeY2DbTT3tbDCgoxjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539394, "uuid": "f1712b82-d834-4728-a96c-1ee86f8f7a31", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539394, "uuid": "91077b28-228f-40e8-bbc0-5b01cb35a8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539394, "uuid": "7152cc71-e39f-441d-8a78-8a4a7f32761b", "value": "e-dekont.html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74438a7-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659513038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513038, "uuid": "11ecef32-0c3e-4e7a-84d6-247dceb54c64", "comment": "Malware payload (DBatLoader)", "value": "0ecdae9fca6925995ec4a3db95462410", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513038, "uuid": "14ba3d74-d9d8-40dc-a199-821eff3e1b96", "comment": "Malware payload (DBatLoader)", "value": "9a6b3814d1571fd30961206eb15d3affec6486b2ce1aa144d6f3a7854cecad60", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513038, "uuid": "dc5419a7-bad3-4dd3-aafe-7e796e1c3684", "comment": "Malware payload (DBatLoader)", "value": "821b698a5ff5285cab17f8a139307cd30ad183a1", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513038, "uuid": "e562bae0-e1ba-4b0d-baef-9b0494e93359", "comment": "Malware payload (DBatLoader)", "value": "65440e26487e7a6b36a8c056b9b6496d385dd67b1af304e13a04dc9f8b42798de87db5a4d3b4bd1accba8d9642178e1f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513038, "uuid": "36b253aa-113a-45ea-9d97-fa5a41ac5723", "value": "T188259E25B2918437D1A31A385D1B93F89827BE542E3494856BED3E8C5F3B3603E753A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513038, "uuid": "c43af606-f39e-403c-9438-e2b186ed307a", "value": "5f2a5ba208506b49b681af6fe077e44e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513038, "uuid": "a5563fd3-308e-448d-b09a-10e2cfc63c9b", "value": "24576:Jeq1bWjPd8Y5Q0MFxdNLdFRlz8d52Ep8r6U:JeLValFoor1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513038, "uuid": "77511dae-26a9-4afa-94f1-f3311bb3de8d", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513038, "uuid": "212f3152-e0c9-416b-a74a-4dd47e31ef60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513038, "uuid": "396cf88f-661d-4020-8a3a-d05012697ae7", "value": "Potvrda narudzbe. RS0324452672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a2e915-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537914, "uuid": "f7109cb7-702f-4f82-a0ff-54cd108a60d4", "comment": "Malware payload (SnakeKeylogger)", "value": "d74ece987b527a42b70b65e078d01d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537914, "uuid": "229d35e0-3025-46d5-8d44-e547cddab8eb", "comment": "Malware payload (SnakeKeylogger)", "value": "9aa6bcdcec6d5302b76fad8ac85da20eac8e5b3119116efeb7fe2130c4c798c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537914, "uuid": "eacea1b2-2f26-448d-b7ee-68ded07e1fd0", "comment": "Malware payload (SnakeKeylogger)", "value": "7e3422ea771d6b63607326e4be8f3943ea1c5570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537914, "uuid": "e9df9554-d7e6-4400-b39e-39da567adb0d", "comment": "Malware payload (SnakeKeylogger)", "value": "247536413b613eb43a463b6cbe3c2d705f52870ec8b9f8351ad1f99efd5515881d7d3eb79faa87a8bf8ded8210380871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537914, "uuid": "21b82347-714b-4bfa-bb53-75e3f2aac3ed", "value": "T1B854F0245DB89A27FE785630F8346433035B9D2BC2F6E3E7475CA74A4544F2884F1BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537914, "uuid": "b60d38c7-7801-4300-beab-8fc0ccd378ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537914, "uuid": "a569a7b2-7132-4d75-a6cf-37db92097f51", "value": "6144:UY9lSSxmJpss8pqKhjUwEy74Ln/jTopgeK/ytX:UqSSSqsMJ9T4Lopg3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537914, "uuid": "8dff3d43-e774-4674-996c-5387bb74466d", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537914, "uuid": "5d653dae-b7ae-49eb-b102-aeacb2147889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537914, "uuid": "61d5a05e-fc38-40ab-9317-b34c03a90468", "value": "Drawings#89332703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f884e4-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522510, "uuid": "bca772ba-506e-44e6-9824-cfbd758aabf4", "comment": "Malware payload", "value": "a3eb530244aa24e71ff88a633afd6c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522510, "uuid": "7b85f4dd-72dd-4a3b-9787-381a7e8c7506", "comment": "Malware payload", "value": "9aaa46606f36b7f4b26420e95a75090d1a933356e994ca69d3af6bb4c3774430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522510, "uuid": "f8aa17a0-b345-4271-9428-dbce3ffd625e", "comment": "Malware payload", "value": "06f3bc15608ac732cdb9070a4be9d763bed6cc7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522510, "uuid": "a21a48f1-9934-4622-96d4-cb1b786ee6a2", "comment": "Malware payload", "value": "f896be9a922ddcf673a2540ebfd5324e8e20fcfe00b6b3eb1ee6c60925a6a7f1e58348663202411882ca591588b92eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522510, "uuid": "de20918c-06e1-498e-9d7e-4ba6cbb3cc02", "value": "T1D02602E8B54067ADC11F0130A03379D8F2744D5E5F9AC667B2EB7B957EBB0A09A03907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522510, "uuid": "93e2af69-10cc-48f6-9562-a81ec40bb05e", "value": "5120f42cb7f6bfbea2075ae8b646c8dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522510, "uuid": "a8c44680-a71b-4062-9cd0-2b194747aad2", "value": "98304:Do/knCgX0MLIx3dV+4qjulk52bDu2MBW6H+25+ifWByEvwSPKPj6ee55+c:DoMnV8dV+4qjIEaq2YFe25+8Evb7eo+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522510, "uuid": "3876def3-c785-48a7-8ce5-9273199f2155", "value": 4435968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522510, "uuid": "10ccc9b5-3f75-47ec-9115-bda67331bb68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522510, "uuid": "c3b2435e-497a-4699-a303-dffce2f77d5b", "value": "9aaa46606f36b7f4b26420e95a75090d1a933356e994ca69d3af6bb4c3774430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66647ed-1305-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659515131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515131, "uuid": "b8e95e53-1957-4abe-9e77-514ce1883d89", "comment": "Malware payload (RedLineStealer)", "value": "1050dbf8cc5dd55bac9f31e0a3e98205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515131, "uuid": "cd975f27-5578-4bfc-ab71-488f21664908", "comment": "Malware payload (RedLineStealer)", "value": "9ab724ffa4cb578db0e3dc72cf1d6f2f63fbce657da0792f0b86269c47b84c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515131, "uuid": "49897ba1-93b0-4270-a2c2-529858c25f65", "comment": "Malware payload (RedLineStealer)", "value": "cfeebbbc3fff7c87f33a70e46f282b7dbc338ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515131, "uuid": "55a46903-f4f8-4479-acf0-6a193a986d82", "comment": "Malware payload (RedLineStealer)", "value": "318cec73e9cd1a4c09d485a428a67f8a0a01459ce3b13cbd3f75dae20252b2b4d96c1aeda7015cb3c2dedc0bbe5cee8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515131, "uuid": "e5263d28-348f-4e70-95d3-c3ea6786f72a", "value": "T1E854E001F2B0C83EE5A65630587082F5263EB8217A74954BB7687B3F7E31FC16AB5352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515131, "uuid": "9fcbce86-f3f0-4032-8531-559748810dac", "value": "659d79d576f567aca5af5842bb1fc5a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515131, "uuid": "b3c8a7d2-7f14-42e9-a1b6-cd4ed189673c", "value": "6144:uH6c0Pbfgchqftin5yJjaAkQG+RfaPOf28i6w4G2:uiDnfkJNzKPOf28ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515131, "uuid": "87dad29f-3976-48a2-9e38-e5ec1ce88f11", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515131, "uuid": "95e23238-e8ae-4bb2-ab17-ca23b1bdb7d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515131, "uuid": "ea78bb9b-2a70-40da-aec0-1371a199b7cf", "value": "1050dbf8cc5dd55bac9f31e0a3e98205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1a6ca5-131c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659524668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524668, "uuid": "2a4b274f-d5fd-434f-8c02-851c02228e53", "comment": "Malware payload (AgentTesla)", "value": "dd877655c5f6d8cb1a2410ad6fa2b651", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524668, "uuid": "2e3ca416-7000-4d2e-bfae-63d90d7ff926", "comment": "Malware payload (AgentTesla)", "value": "9b5d842d0302ffa4ddadfc2c137c28e414a4964c2be612035c64355b3c0f710f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524668, "uuid": "b957f62a-c531-4a32-bd7a-f1a12a6ec628", "comment": "Malware payload (AgentTesla)", "value": "723ffa7b49b7339129a061dcb8aa76de053b061e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524668, "uuid": "2ad38c1b-2792-4fe1-8e21-3504bc37c96b", "comment": "Malware payload (AgentTesla)", "value": "5c0256eea5aece0ba20386fcf821add2d16e459e0465f455ec911c36a8d8440a48349c7c5da167be7416bac5e9dbafa2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524668, "uuid": "43895910-00a5-4057-8dfd-316779ca8be6", "value": "T1D255129236FA5B23E4791FF1B920415517B0A23B2522E28D6EDE3DF31B35B130B6095B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524668, "uuid": "746cb83d-4aa9-43d4-9c54-20d2c18012ca", "value": "12288:vg6SKlpxo5ZxdtMmlUMZkrS039WbRwxpfH1/070heahF70Eo:BLlpxoVDMmOMOrSpRUdO7SeaDwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659524668, "uuid": "314d5643-8109-456f-a443-d8d49387af2b", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659524668, "uuid": "8aeb94cf-04c9-40a7-9834-843ed4c2ca0f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524668, "uuid": "35e93170-3590-4658-bcb5-edbcc8150fc2", "value": "TTRANSFER SCANCOPY 099112838377909_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859cf14c-1333-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659534752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534752, "uuid": "fa363209-7d01-4511-827b-d1ee1891da97", "comment": "Malware payload", "value": "db528e33bb9e20b0fe0bfe127888318e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534752, "uuid": "1884b570-f7c7-4483-bf74-ac7390ff830a", "comment": "Malware payload", "value": "9cb4d31e63ece3b15cc34bf6aab9fe982d492f4712fb2019976d77bccc111920", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534752, "uuid": "fec29899-6b86-48b6-9584-0e2f02e37584", "comment": "Malware payload", "value": "5ec87d273c15ce4dc8c0e23879a5fabb62b580e8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534752, "uuid": "6c7aa785-3706-432d-99d1-141b82c5ba69", "comment": "Malware payload", "value": "cd5a8fbbd89a9daca097f1ca55987dfdfe3c3919a1a5d44078e1d7df1059f347d2168c88a55372a036a7c5f1d43879fc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534752, "uuid": "54c0d330-9e9d-41c0-9f5a-57d0697622e4", "value": "T1DA05234EDBFD16C8C8A77B9C8D43A97638C05062871671E20D806A97EA259F2671FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534752, "uuid": "644648ed-3748-456a-bc08-234d54e7e526", "value": "12288:MyID7Wjzg3hbJL1VslTtrTMnpqc+QE3kzCZikZ9mNhJfyFEoDb2zU0g5bikKTk:MD7WI3hVTirwnaMGZig9m1qFb0gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534752, "uuid": "a250f17d-5c5f-4c21-9262-451fc36bb9fa", "value": 851290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534752, "uuid": "34e936f4-a87e-492f-a69d-db9896a66ade", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534752, "uuid": "daad386b-0e12-49ce-9dab-7520aa4d451b", "value": "db528e33bb9e20b0fe0bfe127888318e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacd7f06-1344-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659542143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542143, "uuid": "4adc4734-fad3-48cf-b1e1-12fe57f06d2d", "comment": "Malware payload (Loki)", "value": "3925a6e1efedf45e38d9ee093263cfb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542143, "uuid": "cca25331-d8d7-497a-aef5-02685d2a956c", "comment": "Malware payload (Loki)", "value": "9ce705eb03e939d34b61936fa0e465af2dd81a60f3733f0499aaaa38dc1306f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542143, "uuid": "45a67133-76d5-4316-be44-5805f7bf602f", "comment": "Malware payload (Loki)", "value": "9e839b278679f2462f92adb862859d97e1b01306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542143, "uuid": "bde10815-10a2-4bd7-859e-f16c8cbccc47", "comment": "Malware payload (Loki)", "value": "dc0434554e5aecd8e752de25ded150768dd19663b3e2bc1063d4a5374acda5f5a512a2798e0112f63b26f8608a5ba3d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542143, "uuid": "539ee708-425d-4b84-ab07-1b928a26816f", "value": "T131556B583750B69FC85BCE73D9581C20FAA0A56B830BF347A45726ED9D4E69BCE040F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542143, "uuid": "70ce7612-7cae-45b6-8b51-9adc1929bb5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542143, "uuid": "e1bdca17-e088-435d-a3fd-7fc30f7662cb", "value": "24576:9q6HY7wO2VOeJX+jeEvFdNuI2FMAhuHKFQzm9IUCxuEQ:9/HYWV9JHouFThuTzVUCME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542143, "uuid": "d22b74d8-ab0f-4121-909a-a352f0f1c3bb", "value": 1370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542143, "uuid": "b6e8a8fc-da6f-4881-a7cf-8c6d11b6d5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542143, "uuid": "e3b6093b-03c0-4ec5-b904-75c3b9b2f13b", "value": "3925a6e1efedf45e38d9ee093263cfb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80895fc1-12f2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659506826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506826, "uuid": "c6287af9-f8a0-4dd1-b926-7390604c73e5", "comment": "Malware payload (AgentTesla)", "value": "c141dad4a578fd55865d164e473dcb01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506826, "uuid": "8df39cf6-6dcf-41b1-b587-abc2da06ec06", "comment": "Malware payload (AgentTesla)", "value": "9d4d5ff79262b587e624703fc677bcabc74e227d6dd5b5186ef341598b0934bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506826, "uuid": "3c637993-b3f3-4bbd-8cb7-8f524acfa0bd", "comment": "Malware payload (AgentTesla)", "value": "2bcb2d88f033a8eb9a06042ce5fb65972268d36a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506826, "uuid": "b28dc76d-dc42-4baa-8401-41f8a8e9a745", "comment": "Malware payload (AgentTesla)", "value": "656c0710f2f09b600ffcb9cf5c0c6767a365357c70fa1a2e58cb8033bffbf6124819c831ced9ded46d0ec5f5bbe0bee2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506826, "uuid": "753dce2b-7d61-4955-bf47-10a0349628ec", "value": "T18005E05163B98707E47A1FF2B5A000541FB3B66A7167E39C5CCA78EA1EB23434A17B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506826, "uuid": "37c99e4c-def8-4c7f-a4a9-242fe49a5b82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506826, "uuid": "a7322bb8-6e08-4576-8d5c-8ad5fe355b35", "value": "24576:7ELlpx8UbZD93yDLS6y8Qzfeqz45sM31/9O:7o8WZD9iDOPheqzSP9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506826, "uuid": "6edbd0bc-ef38-40c3-b9e6-90f608b5112d", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506826, "uuid": "1ffbc6a7-62c4-4f0b-89a2-55166cc6e690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506826, "uuid": "80ccf060-74f5-4bed-8d48-36a85c21e4fe", "value": "Quotation 1868939_2022-08_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3d0902-1350-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659547329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547329, "uuid": "8cb772a9-94b0-47f6-b7e2-f20537ed418e", "comment": "Malware payload", "value": "02f951f450e8bc1993636db85bc6365c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547329, "uuid": "f29e36d3-d7a5-4b07-b87c-a256b7d167a0", "comment": "Malware payload", "value": "9d593bd3f856e8e9fe4b9517b8b5542068a5c37aba2d0f88f69bc3350b92d0d0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547329, "uuid": "030bc76f-863e-4bfd-8556-10dbc7481934", "comment": "Malware payload", "value": "a42202442e9ac746e02f892898df8fe9881a2818", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547329, "uuid": "f9376c76-45ba-4a4d-b879-7756ba6b76eb", "comment": "Malware payload", "value": "9122772bb7fca4c7573ab7c80d8019afbfaf949682f03786ecf5210450d5ceb85d1bd8ef12dc6125414eb7a37ad9c359", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547329, "uuid": "54193a52-fbe2-4c70-9efd-e0aaf508dac2", "value": "T13C342316E36AC8EEF0D5087084720B60638E2680C2F16F5DA75FE2D6F95BADD164F42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547329, "uuid": "0979e8c2-e4c8-425b-b383-6d2f8ab16c0c", "value": "6144:PdztQUExdO4Z0JNaxGbQU6U8sn8AeQHXX/+VyyVtszrDMuN:PvcBWNa9ylV+7OrDPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659547329, "uuid": "6db45b9c-3811-4aa5-b85c-2d4d5f0b10d0", "value": 240168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659547329, "uuid": "cbe4ca9b-66ba-4b77-b80d-cb860d65409f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547329, "uuid": "e489e2aa-d45d-4cb2-92aa-07cdcb81c4ec", "value": "August_020822_9702_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d69c34c-1355-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659549234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549234, "uuid": "1bb51d6f-18e7-41bb-927a-6296e2198ef1", "comment": "Malware payload (Gozi)", "value": "aa856dedda137f7419ecc36766ed74e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549234, "uuid": "2cbb43fb-e4b4-4f3c-85d7-479b7d79d1f7", "comment": "Malware payload (Gozi)", "value": "9ec85fa9097826fce61020be2f15ed01c320109c7ec3654c2a42b1b5c46b4b6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549234, "uuid": "2639c5f7-716c-4e73-a550-86518f7fb374", "comment": "Malware payload (Gozi)", "value": "59a685b1ddd500747678ed66ffdb1afadb7b8023", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549234, "uuid": "3809a06c-faf2-4392-8c88-6d0b233d7854", "comment": "Malware payload (Gozi)", "value": "7a9782038ad9874603c3370bf0824552d30edde8470ceb961125f481bfd42aaf9c5ad84e6915ace644f33540cc90e04a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "gozi_ifsb", "colour": "#92AEB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549234, "uuid": "f3d2ce81-e23b-4afb-b718-897189957d1c", "value": "T180649E757500BCD6E66E56F7EA5ADDD813726A329D86E8CEA0607FC60463362EF01C03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549234, "uuid": "fcd0b542-aeab-49c8-9037-a0c80ff0b82f", "value": "6144:afs+WIrCuHwcIfANlO3MGuH6AiT6nMIMrhfTtOwue9Lign7JEf:Ws+TCuQco3buH0T6GrhN7zFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659549234, "uuid": "f9dfff65-560b-4a82-8e16-c1b4b913bcef", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659549234, "uuid": "4fc98aa3-59d6-4a70-bb1c-efabfcc8d46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549234, "uuid": "e2c4ccc1-446b-48fe-86a2-979176f150d3", "value": "aa856dedda137f7419ecc36766ed74e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a8d338-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542731, "uuid": "648fcae5-2144-4736-ad32-5e91e7b1d15a", "comment": "Malware payload (Mirai)", "value": "43f3ed11c90a9dbd3b295ff4ec047efb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542731, "uuid": "68eb5b05-e88f-4c09-aff6-720cc23bd678", "comment": "Malware payload (Mirai)", "value": "9f0cf8ee6b48f0fc481e12b0fb7cf5c020f5f78bd29543f9840ec5fc0eaf309a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542731, "uuid": "00a1b358-4a41-4bb7-b0be-f8645d8cd982", "comment": "Malware payload (Mirai)", "value": "3c834c697b10238d3245486898042e37a8a0bb7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542731, "uuid": "af1acafe-0565-4e84-8fbe-0db0a5c456e6", "comment": "Malware payload (Mirai)", "value": "040928ec1da63438d49202aaa9602b7c111197019f1ba9f5eb494ed08be06a618fa06dba819e54a764ed7ddcc99e833e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542731, "uuid": "cb3bbd0d-e83f-4b2f-8c0f-51bb474584d3", "value": "T126336B36E029DED0C5960234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542731, "uuid": "bd484022-925a-47ff-9afe-b3e1374b5817", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+ydZCZQoVjfjmCozw:Oa4U7G7SvT6ftBTydZKVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542731, "uuid": "3a644ebb-14b5-4a0d-94f8-c168abdae943", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542731, "uuid": "ae0c71cf-b10f-4a8a-a113-7a3a269ef471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542731, "uuid": "b2bcb8b5-354b-447b-b48d-c4f7cc1e7e6d", "value": "43f3ed11c90a9dbd3b295ff4ec047efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b09fa2-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522557, "uuid": "07f0f419-bc36-4865-a7c0-91b85f5bf4a1", "comment": "Malware payload", "value": "8e0fe5bce9b2a9a6e2f83f679d6f1112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522557, "uuid": "0ed6e69d-7a4e-4397-83ec-885b70141da5", "comment": "Malware payload", "value": "9f665e80fd30880ad8a4e5955dcc7159d05d89dbaa691d7e4d162d402952b4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522557, "uuid": "1f8ab2bc-eaee-41c5-8049-a7b1effcd5ce", "comment": "Malware payload", "value": "3112266c3e423a03f8438d99f5acea6465ac055a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522557, "uuid": "603cdb2e-32f4-4b4a-a74f-fb5482143f3b", "comment": "Malware payload", "value": "ff4138deff21dc5d6e52db0d2c5e0a3eae2bcbceb0b121f55734da005b544688620d64a636d309cdeba4166daea45a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522557, "uuid": "0e3b554a-cc02-492a-9f99-83a959a1d310", "value": "T18F8523C2DE68153BD1735470A84765CDE5B90DE22F6AD4BB03E683DB79712A8E13E203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522557, "uuid": "2cd6a76a-b147-4c34-8b66-d889c7a540cf", "value": "e0912741c855bfb82c0bd8b8bb1123f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522557, "uuid": "f29267a6-bfef-4ff6-9290-8372d0bf934f", "value": "49152:OKjwFIZcqZDQ0xzs24wq6Ed5hSKp4LTY/wYNML3:ZBZcV0W2pqrL3/bNm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522557, "uuid": "923adac4-4939-4ba9-b05c-3051eed932b9", "value": 1712128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522557, "uuid": "a90f670f-5038-40c4-a5ac-d9d92ae231a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522557, "uuid": "9602a2d8-0e54-4680-a3a4-538e9606dbca", "value": "9f665e80fd30880ad8a4e5955dcc7159d05d89dbaa691d7e4d162d402952b4e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a94b00c-12f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1659506440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506440, "uuid": "26331e6e-5c91-44ad-8734-3f8396f50521", "comment": "Malware payload (njrat)", "value": "0eb9eff1e670cc73774abba28abff88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506440, "uuid": "a909e867-d8c4-4810-8018-eef87a5b4e44", "comment": "Malware payload (njrat)", "value": "a04b37af97deaa6cc1654739372cd995c527192a3ac228fd4d32bd02bca0295d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506440, "uuid": "9ee11ec6-5a87-4e9b-a3ed-9d2f34e78794", "comment": "Malware payload (njrat)", "value": "9cc4463b41e38af4b96f85fe48180c3f9ee0ba79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659506440, "uuid": "8eaa38ee-7a40-42f7-ad44-db4a5681db76", "comment": "Malware payload (njrat)", "value": "1d59620ec34762f719adfb7eddeced7634ba3c86e100a25e1d261e5e4fb955be086c6bfd22784be69ced5cebc66517fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506440, "uuid": "2a54cf71-5df0-41fd-8afa-f9abbc2779b2", "value": "T149C38C0BBA50C521C16C5B3EC4EB55040778BB835262EB0FB98A6F467D437CD298E6DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506440, "uuid": "e2bb5ab6-9d91-4236-ae68-4444b789e322", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506440, "uuid": "34973450-8aa4-4f01-87df-d224b6a72224", "value": "3072:nPZelkNcsgLh02k9Hc3/nl6LAHkzI1UfgEA6IIyRj:nAlJVjk96kAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659506440, "uuid": "cd4067a9-6c39-49c3-b7f1-248acbe77d03", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659506440, "uuid": "10be8eae-7ba9-4f0f-aa0d-378f5509bbd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659506440, "uuid": "84ac88b0-61ec-4d03-a0cb-af2a00dd92b5", "value": "0eb9eff1e670cc73774abba28abff88d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38efd3ea-12e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1659500264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500264, "uuid": "a93f2a5a-42c5-4cdd-a8ca-9241dfafdd94", "comment": "Malware payload (NetWire)", "value": "2c9e24d3c041a463e8bb0d9d98606b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500264, "uuid": "04e34c0c-f22a-4eda-8c89-81f8eb80c424", "comment": "Malware payload (NetWire)", "value": "a1bc1aba176e99f0531b911a04d6c636ef21dab12d24026c672829d0c624e16e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500264, "uuid": "ba22f0b8-480f-4d5a-bd6d-7353060c6c03", "comment": "Malware payload (NetWire)", "value": "90a5098f8bf91b22b9688feeeb536ac1c0c7d4bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500264, "uuid": "e661c2f4-3c37-4372-841e-4023e2aaa57e", "comment": "Malware payload (NetWire)", "value": "ec02421f7b98c9765fa42fef3d10e8a45ae68f31c0c8db48e4dbd8e8c17efbb6ca10e6a9685a32fdb4b3758c001ae942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500264, "uuid": "f46b30ee-d23b-48bb-aae3-3b971b6987dc", "value": "T1ED55DF8157988A01D87B0EB4E3A114149777EDBDF9FBD2C88DC738DA9A367C30925A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500264, "uuid": "b8b3ff7d-b3d0-44b7-9319-c043f54495ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500264, "uuid": "d71d201c-31a0-4cd8-9e5d-f58ce7090ef0", "value": "24576:dGLlpxy2/ogv1Q918U8Iu7i0b+W4jlNGd54gnG7RJK:dSy2/ogv1Q38UA7i0/43G71nGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659500264, "uuid": "f63085d9-7c3a-47bf-9e67-3bd05abfbf08", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659500264, "uuid": "1eb4e7ac-2dba-45ee-bce5-93184ed07e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500264, "uuid": "1098cd24-ac3b-4055-9431-a1bcff676806", "value": "SV38848934334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e5a84b-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659511880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511880, "uuid": "7b447a82-0cc5-4283-8137-47e509266b94", "comment": "Malware payload (CobaltStrike)", "value": "459b0bdd45947e5861ce2d876c3c4033", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511880, "uuid": "eda1a5b2-3131-416e-ae65-630320e193fb", "comment": "Malware payload (CobaltStrike)", "value": "a2d546749333d57f7370f528e63ab3b688f72b2b33fb33bdbcab494efc766bd1", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511880, "uuid": "e99b1449-f55c-4e15-90a9-586262ad2998", "comment": "Malware payload (CobaltStrike)", "value": "cce9113d8a8b515bfb7d83acf7b1996994144a33", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511880, "uuid": "5f7a48a5-c136-477c-83a4-20c834e16814", "comment": "Malware payload (CobaltStrike)", "value": "55a7b6182cf0c5d855d119bbf3c550256f44688670e739aae1fec7283aa86867fd42f16bf4a37f3aac9fe7e4211ccbc3", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511880, "uuid": "f667ab01-24e9-4112-8552-4beae8848a35", "value": "T1E1947B1401268397DAB51DF307D572CE8C1320DEB8B4CD272766DA6E47B23A7E91A23D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511880, "uuid": "3af89d0e-3922-4576-baa3-a292b40b1ff2", "value": "e90de0c769aaf7f6d42e62efc3778812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511880, "uuid": "48b26469-0fce-4f54-93b7-e8d722873a40", "value": "6144:r5nJbgFuOg/WOWu38XMamM+/FnFnFnFnFnFnFnFnFnFnFnFnFnFnFnFnFnFnFnFn:5VO/OWqE3l5zrCZBUeBI8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511880, "uuid": "f9e44b37-7ca9-4b84-8b30-56daf85d661f", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511880, "uuid": "0c1b23b6-d796-4e78-8630-15ea462a6121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511880, "uuid": "d1978a38-788f-4dda-841c-42838248d897", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce45134-12d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659494096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494096, "uuid": "59122e88-ca45-4e28-a67e-161f982b1269", "comment": "Malware payload (Mirai)", "value": "3be4d3d2d2f819935e15d49bfec56b50", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494096, "uuid": "ed2e5dd6-73ee-441b-9107-fb3d683f8afa", "comment": "Malware payload (Mirai)", "value": "a33f73017235f0561278e525f4314bb00a5f30a632c614eb77d8e905a22c52bf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494096, "uuid": "df254f71-69e8-495a-bcf3-68cfd051210b", "comment": "Malware payload (Mirai)", "value": "032190eede3cc965e675dafb99ca64934b86b5d7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494096, "uuid": "2380223c-1b59-4890-8f60-e7d7c499e7d6", "comment": "Malware payload (Mirai)", "value": "53a8a439c324754fac66cfe43304d6dc95ed5b2f3d53f6fc953554b3d5b91bfc93246a658ed601ffceb5761a2e27f56e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494096, "uuid": "23aafec8-d00b-43f2-a494-06191935c81a", "value": "T142A2E16EFF6042CCE44A853E0DA724A396BBDCA7434946498963C5C305C3AEC959FEB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494096, "uuid": "f98e7977-231d-4fd6-bad3-d873e4c88959", "value": "384:pDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chwCZM4/adXWHGg+FEsPl6JjK5O+tcf:pDZ5Dw7RjFjcU+O24sDeZMSaNWmlFEsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659494096, "uuid": "3f25a160-b86f-4285-b935-0e45aab3850b", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659494096, "uuid": "224f6dcc-3d8d-4849-ad52-bbc2a48c314e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494096, "uuid": "f57e12ee-1acd-48b8-be53-a8c9417da3d4", "value": "3be4d3d2d2f819935e15d49bfec56b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc2306e-133b-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1659538334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538334, "uuid": "1b592628-248d-412c-be34-f83803aa04cb", "comment": "Malware payload (AveMariaRAT)", "value": "d2702e0821b92a20fe68000f0e7edf64", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538334, "uuid": "4a02602e-7e10-431c-9625-ab188eda8729", "comment": "Malware payload (AveMariaRAT)", "value": "a4269c2ac4bf7b186b55d8a750db6ae386026d8e51d1f2d21995260a05e26024", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538334, "uuid": "4990c2da-f935-40c9-98b3-0b75b9025d2c", "comment": "Malware payload (AveMariaRAT)", "value": "319d36fa208df9cdfecef58fad872e1bdbe7b81c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538334, "uuid": "0efe28af-83b1-40fb-9634-c01aa5c5e1a2", "comment": "Malware payload (AveMariaRAT)", "value": "ae3cc31620e1a7d1fa13ef789b76530b4d98ca27de310b58e5197dc647f7526021b5844f1622df96544ebfba112c59a6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538334, "uuid": "63c481f6-2db8-4017-8e50-08e172093fa3", "value": "T194D38D13BBE64436E6F202B02DB97E7597BCF9341A25C68BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538334, "uuid": "fa273bf9-03c5-4505-b189-36d117decec0", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538334, "uuid": "1fcf3e38-b91a-441c-a73e-1adc08aa61d2", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659538334, "uuid": "4b440ecb-aedf-480f-9338-d1c4035bc05b", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659538334, "uuid": "b849ab6f-1adb-4bd9-85f9-509dedd47dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538334, "uuid": "2970dc71-cd87-4d64-a789-f24397687983", "value": "d2702e0821b92a20fe68000f0e7edf64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be75bd8f-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1659539572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539572, "uuid": "fc615c28-e344-4b17-b50a-21ac23b2c181", "comment": "Malware payload (STRRAT)", "value": "520d525d9363c8af18464aaab531bdee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539572, "uuid": "19b5f152-7c06-48bf-810e-5436807ce4bc", "comment": "Malware payload (STRRAT)", "value": "a46d634bd347326661cab1b278c9412b48fc2f631635c5bdbbc5876a30df456f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539572, "uuid": "98b8667e-3d15-46ab-a1eb-56a8916feb4b", "comment": "Malware payload (STRRAT)", "value": "548772f42314ddb8d7c8af88033b645e4a827151", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539572, "uuid": "ae83b06c-ea6d-4ecf-ac61-9f2f4c4457fa", "comment": "Malware payload (STRRAT)", "value": "f50f1f8190d5671f9ac8e064f3efa444f6a855ed409bb59eff24cc305788d15edbc42bb27218e890cc323c009ee758f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539572, "uuid": "b42f473b-aca6-49aa-a5f4-53bd1c3b3e89", "value": "T1E1244A6BB5845F7A79640835AC8603324F9CD6DF2D35B0A6D5711FAEE22AC5DB00F2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539572, "uuid": "f38ab095-e4f6-4de2-a0a3-b44b9f56accf", "value": "3072:IHsZreD9CH4lIZCLs9/ioMVyRLtE9f4kA2Wih+EswAEovEgUeaOZ3sEkdbZHC+Yc:IEM9tljLUio/tE9QkbWSspEgUaZ8dim/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539572, "uuid": "57c2e81b-791d-466c-9362-c868386ba0a2", "value": 212270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539572, "uuid": "94bc4872-b71f-41a6-bd6a-712574fd3c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539572, "uuid": "53d1ca18-7451-4e61-8536-3c6dd79d5ec5", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0655dc01-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659538833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538833, "uuid": "217508ec-9686-4dc9-b29a-2876972726e2", "comment": "Malware payload (Stop)", "value": "a0ce345c21653d642e0a4204ebb522fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538833, "uuid": "0e06a4be-bd58-4e5a-8687-709bd19c6037", "comment": "Malware payload (Stop)", "value": "a4f6fc8c12b08c7957bd3c76abbfa82157ab298c89a769c0ed06e14a5b830bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538833, "uuid": "6f488cfd-8e88-4366-b7af-2a32f6de07e6", "comment": "Malware payload (Stop)", "value": "6408c07b5a69f29867335e02c49f007bf92ac444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538833, "uuid": "910ed922-ab28-4783-a3e0-bab7eb0d1679", "comment": "Malware payload (Stop)", "value": "fa68f4eef752d76fa7e992c3b94414e03fada79a7c61c6dee4915edd17b6680d3d8aab644a88a1b6461f298c3c2652d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538833, "uuid": "7ba77086-8d43-4762-95e2-c02a6269b585", "value": "T12BE4121173A1C036E6F67A7054B8FBA49ABBBD6217345E8B6750122A3E613C15E3C783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538833, "uuid": "f6a73976-6745-4727-a6d7-da6d577e1dc2", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538833, "uuid": "ab8e67c6-69a7-46f1-ade9-25032250f44a", "value": "12288:WVbNyGe9VBG07AMsZMpW/goKfW83S/DAMQSlln30gb+qFpwP6qIKYU3:WV0GGjGeAMsZMpW/TKfW1iUEgi6q+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659538833, "uuid": "7bdfb713-3100-4b62-9996-fc652464a7ef", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659538833, "uuid": "5262c0d6-d1c0-44d5-9d0e-04fb1ac97c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538833, "uuid": "98b03335-5bd8-4f9a-987b-e49cd7b063c0", "value": "a0ce345c21653d642e0a4204ebb522fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa94756-1307-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659516032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516032, "uuid": "1fc1ede1-1c5e-45b9-8cdc-81479dce1ab9", "comment": "Malware payload", "value": "46584407836c832a1b9b72225c6494a0", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516032, "uuid": "25cae058-c445-4d62-89e0-cb16a656329f", "comment": "Malware payload", "value": "a6e439d10a521e60b7e18f6a43e59049399ce3421009910c30ae7076384b3c29", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516032, "uuid": "d405bdfd-d122-45db-895c-5239d30d9132", "comment": "Malware payload", "value": "4c46b983bc33aeb430daae36dc0ef0a8958db006", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516032, "uuid": "5959c4d6-dddd-49a1-94c4-725fb5ef505f", "comment": "Malware payload", "value": "d6ac12aca4ea71f86602c0499906b4736094978619f971c6696e7761adb8effa71a3251569916f961dc741d3903325ed", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659516032, "uuid": "ec46851b-afae-4ba5-836e-982e9f165ed7", "value": "T132F25366B28ACD4AE945073A4DE3DAE63726FC859F6387473258F30E1E756C08D03617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659516032, "uuid": "84f8e374-65a1-4ddd-92d3-1c63aacfbec5", "value": "768:XcKoSsxz1PDZL2Qiw+4868O8K/5Le1k3hOdsylKlgxopeiBNhZFGzE+cL2kdAJfq:XcKoSsxz1PDZL2Qiw+4868O8K/5Le1kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659516032, "uuid": "d66a96ac-6dcd-4803-9382-50e39ad8b7ba", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659516032, "uuid": "9a12d02b-5f6a-4cea-a4bb-026776901241", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659516032, "uuid": "65dcdda3-c64d-4d3c-a528-89560e44fa45", "value": "a6e439d10a521e60b7e18f6a43e59049399ce3421009910c30ae7076384b3c29.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d663a0-1355-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659549239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549239, "uuid": "17ed95a5-5cdd-45fe-9906-93ba6831afe4", "comment": "Malware payload", "value": "329f857398b9b41125b30d4f270d7863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549239, "uuid": "2650612c-a396-4326-a99f-bbda8d102f0d", "comment": "Malware payload", "value": "a73cd4dc98981e98e2e96af6ac856f4912ff17db0ffa985dfb06578bc6a751a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549239, "uuid": "72bfd882-a086-4fc6-b974-60ed3d2196c4", "comment": "Malware payload", "value": "91fc241a04365d4a31869fefb7f624b6e9ac0a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549239, "uuid": "b8921184-027a-4600-b3db-95c680eee30e", "comment": "Malware payload", "value": "90a9adc756c336b84151e565eaa279caa88276d913a7165313b97cb86b4513672dca18a024be563fb15a677a0e925301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549239, "uuid": "c4185750-cb40-4227-9ec0-77a07da8968b", "value": "T16D555A4103E4FA78F23A23F6412551448BBA615786B9F60EF9AD31DB0F36BC0A54FA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549239, "uuid": "4789e574-396e-417d-9d7f-a5a9c9a71862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549239, "uuid": "80235a16-88e9-4169-94e5-da9eb3268fd1", "value": "24576:rxrcy9QHPYRNdrMGF0Eg9+O3vfkfmfg+MgxP:rzRbRLgG+MgxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659549239, "uuid": "eedf5ae1-c3c8-49e6-ab44-564e3b8e033b", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659549239, "uuid": "a7750cda-dc09-40cf-828b-8511986dbce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549239, "uuid": "1184dcd4-60ee-4157-87a2-9cd37e4343d9", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1154be-12dc-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659497449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659497449, "uuid": "5295650c-d172-4b84-97f7-9d75023b76c0", "comment": "Malware payload (RedLineStealer)", "value": "11e593e7f7afdd81bd0407fd4106ccac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659497449, "uuid": "5f548ae6-2099-4cea-9f3e-d07568576514", "comment": "Malware payload (RedLineStealer)", "value": "a7f61df4c6ab265e521671b6e13ed1f190255dc45497b9084f6b2c36efb7e586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659497449, "uuid": "d0bebcc1-1377-45b7-9fab-5f58c0723c31", "comment": "Malware payload (RedLineStealer)", "value": "01429ffed3a0865578ec547e5b36a5dabf8a8798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659497449, "uuid": "b0e30e4e-08ac-4647-9c3c-5481d6afadee", "comment": "Malware payload (RedLineStealer)", "value": "69f227a21bb5bf28a10615dded45765d7b750c5f3fb2561aa56f9b2477c396ab96b0c2d128dd3bb5a5d1e3b942625237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659497449, "uuid": "be60ee22-a547-457c-8bda-2edf4daf9263", "value": "T19F5416CDFEA04831C5C4827C9155B2A065EB7D2CEB20A13F659876299FFED83DE31192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659497449, "uuid": "8ea93504-bc14-4e24-8c81-b6373a82e7bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659497449, "uuid": "9fa13e23-e32a-4249-a514-33f35b474d26", "value": "3072:wagMZlxe2FYot4SMbSOVMXxNa3ge7wbjsEHpIMC1n0uTdhHd1:wfT2ySjOVoNaQc0pNO9HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659497449, "uuid": "d467cea0-4369-45a0-9bf7-0e7b6a154639", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659497449, "uuid": "4516b8a7-5e1f-44e5-a19d-c1ad6f3ffbf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659497449, "uuid": "658f9085-cb24-4502-b174-0ed694aaf1ca", "value": "11e593e7f7afdd81bd0407fd4106ccac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494ed1a5-12e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1659502438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659502438, "uuid": "5de50337-7c75-44dd-b665-401fbe182e42", "comment": "Malware payload (AveMariaRAT)", "value": "22bb1fdc6a3af23af7b9430a8c48d748", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659502438, "uuid": "5463e580-34eb-4e10-9c42-9f0533f7f61e", "comment": "Malware payload (AveMariaRAT)", "value": "a8da40be896d2c9c2c5621e999cf56c9a4e36b28e6f4a846ef51c24284857b0c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659502438, "uuid": "4177b9c6-ed38-4bea-b0cd-aa05e37976e3", "comment": "Malware payload (AveMariaRAT)", "value": "a735bd8ccf19a91860cbf2ccb854f20cb27db7d4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659502438, "uuid": "ec05c300-2571-433d-bd17-441c810144f0", "comment": "Malware payload (AveMariaRAT)", "value": "b897df7353a877b56713eb09278c8725466a4d9d9d780c1700e670b98d515749fc14798329a3f38024aa4a3611a74783", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659502438, "uuid": "505eabda-fe67-4f7e-82a5-5ebac9ccc1ca", "value": "T19E15F11173B58712E4BA4FF1A9B440140BB3B66A7127E36D5DC938EB1DB23434A27B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659502438, "uuid": "6fbaa7af-264b-4573-bc6f-8468b99c8e71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659502438, "uuid": "828f2607-28b0-4421-864f-84108aa05005", "value": "12288:mMn/g6SKlpxoW/ZGetsVY0O/YI2MNY37dY60Sg36ZO9vWJoyxgtg67VBRW:XRLlpxoaqY1/D8JOLyxg5xBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659502438, "uuid": "67ceed40-1a7f-44b6-9f17-4d771319ddfb", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659502438, "uuid": "ddf716f2-18cf-442c-9d91-fab164e46cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659502438, "uuid": "832816c3-596b-43be-bcb7-263eb726c325", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7954.23440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a233251-1369-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659557979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557979, "uuid": "73f1f204-6fbb-4f60-858c-57bc9086eb3f", "comment": "Malware payload (Formbook)", "value": "4b9f87da8585322a63d6cd856371bf07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557979, "uuid": "f4e8c9cb-957e-49b0-b8c7-bd73dad0cfd3", "comment": "Malware payload (Formbook)", "value": "aa7834256cca5115fb38322cbd14a7dc808ebc12b061a9049b2b7ba62c2f0f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557979, "uuid": "1b4b3be5-09a7-442f-8de4-06cacbf96e2a", "comment": "Malware payload (Formbook)", "value": "c6010f8de0d5229828cf7bcdf8b15b8dde6456a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557979, "uuid": "00120863-fb14-46e7-8e56-1b1c689a6978", "comment": "Malware payload (Formbook)", "value": "6e64e9b6eb1f38cfd6d95d29959634d8416e54020e6b27ea7aaec47309daba7471c0ad8833e2edcf1f25229db8dfeaf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557979, "uuid": "42f26bf7-2ba3-4d41-a2bb-e45a12b09559", "value": "T113A4F187FADC16CCC41555B3E03A867EB208DE97362F5431B7EAC92C5E321490666FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557979, "uuid": "00f89ae3-f86e-4d58-90ba-8aee2540c3ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557979, "uuid": "21b5f9db-e8cf-4861-8a57-f73e335f59e2", "value": "12288:W3fUJJxpWQfbBk1/guDIPbPsFH621hcTv6a1doDYuhHnXJ:RpRFk1Y88oFH621hna1do5JnXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557979, "uuid": "1acb6fda-ba1c-4660-99dc-987734caa2fc", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557979, "uuid": "e81a21af-dd6e-4d6d-b42f-6235400049c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557979, "uuid": "828bfa7c-c0bb-4bcd-81d0-af985505ed5d", "value": "Zahlung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d801334-136a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659558387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558387, "uuid": "abf8741e-8469-44d3-a279-05fb51fea94d", "comment": "Malware payload (Formbook)", "value": "09b0438d7467fe2094b3eee42bd754ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558387, "uuid": "a9472b5f-bd81-4cc3-8d86-dc875351bc14", "comment": "Malware payload (Formbook)", "value": "abee4b16036ceec151fee9b86da60f1cfeb0780eced849b313fc83e467be6621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558387, "uuid": "73e0858c-7972-49e6-a51a-21e2aab888c3", "comment": "Malware payload (Formbook)", "value": "2dfc950321008ee0fa35431255a94c00868cde80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558387, "uuid": "c32ac88d-5164-4c60-aa23-0899ff1e8f14", "comment": "Malware payload (Formbook)", "value": "ed1d9fe79ca8ab5fbe24a64df328b85f98e00ee42a9fa59a70bb0e0b28a99b77cc942fc6f8344c31fb205ca54701f88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558387, "uuid": "be10804c-097b-4e41-a643-08d91020e7ee", "value": "T1A2D4F1D7FF0C299FD0A4EA76323CCF643707D6A3E992405570F8791DB2575AA060AAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558387, "uuid": "791bb75d-229f-4e96-a09a-c9af5998c838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558387, "uuid": "d0027d19-97ff-40fa-a1b9-b0c855a5aa7e", "value": "12288:FRRq2wpsxAToM0ZHuqDyecqOS867rpy4NrmU:FRtz7pHuq+KbBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659558387, "uuid": "bab6874c-ad9f-476a-8ec9-33acb5640989", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659558387, "uuid": "4b439979-8288-4964-af4e-f51a9b0d2f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558387, "uuid": "46067ed3-c46a-4342-b0a7-a605c0b6994a", "value": "Versanddetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a74d04-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522531, "uuid": "67969850-60e8-439b-a4f2-43f13618e735", "comment": "Malware payload", "value": "3a0e88b8460abe668ad29c2ca29bfedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522531, "uuid": "3c92f5d7-90b7-4e44-8345-0510d372a596", "comment": "Malware payload", "value": "ac64e343753c2912dedf804bcb0202cf2aee410b77e52dfb6fae9c0ea610ccbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522531, "uuid": "d27139e9-0273-4f12-b7b8-9a6fa63888c7", "comment": "Malware payload", "value": "31cc463bdac0371af28da8b95e7f63e48c7faad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522531, "uuid": "c7df68dd-a0b2-42b1-93fb-57d56e0d26c5", "comment": "Malware payload", "value": "a819bbb2be2b0e91d42b976e4257fa6f983b1172002568b20c61b82236a2ec6dd011cf4a87a6191162d06366799acfc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522531, "uuid": "3910c93a-8c76-4b00-be01-e4ff78b57c58", "value": "T108E52392CD44093BF17326F05422AAFCD5A25EE52A28D27B03F17663FDB11EA1D35293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522531, "uuid": "f29cf20b-d9e3-40d7-b2c5-0e0c9f30bcc3", "value": "a00164459a73eecbdd307551bd77b018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522531, "uuid": "ae7a65d5-36d3-4366-bcd3-3c1da9d70a90", "value": "49152:5szKMxlmBK+/5b7I6dDLzwK1kE7n9zE3DCTlzckiwOT+FBM5JN:5Xulmv5bU6FvrM3k5NraJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522531, "uuid": "ee2de148-cddc-40e1-9618-8ef254c35a96", "value": 3244032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522531, "uuid": "aa6dc640-38ef-448a-ba86-a011423f5447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522531, "uuid": "741f0c54-8093-4031-86e1-9a948fb49da0", "value": "ac64e343753c2912dedf804bcb0202cf2aee410b77e52dfb6fae9c0ea610ccbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f320f-1301-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1659513336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513336, "uuid": "59177911-ab16-40b4-ba91-a7fb90d74141", "comment": "Malware payload (QuasarRAT)", "value": "f2a7b674d9ad19b016e1fc86db23d8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513336, "uuid": "b08ad06f-0ca9-4f95-9580-aa8984cf56dd", "comment": "Malware payload (QuasarRAT)", "value": "ac6690d6fd604863bba1acb18d6c60da13a5a248adfa58ea502381f71661980a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513336, "uuid": "3758a278-2daf-4405-975a-0f2497d4a3a8", "comment": "Malware payload (QuasarRAT)", "value": "b986f47becfd27d8d836abd52b819f9898b47573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513336, "uuid": "ad29978a-f01a-4ece-9748-26d11f2b7de7", "comment": "Malware payload (QuasarRAT)", "value": "77999a4c0d007d094ffaf97f44aa4c47a3df3a1fee7e9ba45c43ee2678f2e1ee0b331808acfe9af24364f6b4bc663896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513336, "uuid": "80706b6f-131b-4319-b0b7-feecc13bbace", "value": "T151B5122225D5766AF0368E7357D090A95BA0FD52F70AE4672EA23347C3F3DB08D52D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513336, "uuid": "2377f529-8965-4069-bf29-590ec2df09d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513336, "uuid": "2af7a845-462e-4f0a-bfdd-f762dd060451", "value": "49152:3Luyy+QB3p10YNZeG38iucoQUGNRj87+13ux+tlCqfq/5MT:3Jy+27ZeG38Ko0q+13ux+nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513336, "uuid": "b6cbb90c-fe36-4071-a8a2-a5dfaed15385", "value": 2294272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513336, "uuid": "871ee50d-41b5-4df1-a2cd-04390b3cd41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513336, "uuid": "03638c5d-af62-453a-b28c-d9c531ff2b92", "value": "RECEIPT pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772760e4-1304-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659514541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514541, "uuid": "513d8a41-ab78-4bb6-98f1-9d8b4ac5a5a8", "comment": "Malware payload (Stop)", "value": "ad6bc29d95755645224e1e8d4bea120d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514541, "uuid": "ed9ca37f-23a7-4ff7-ba18-c9ecd692acd3", "comment": "Malware payload (Stop)", "value": "b065240e43335f44f4d113f0566093bb40f3dcabc37bc52ee6155ee002f76d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514541, "uuid": "207b217b-a1fc-4200-a5b8-200f9fedccec", "comment": "Malware payload (Stop)", "value": "c022375ae72e590e913f01cec9ae2c5b22643dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514541, "uuid": "50533b84-f828-47e5-9577-39fade4f396f", "comment": "Malware payload (Stop)", "value": "0487a1453bd6057d93c971758f4aaaa4b4681ad2a0250acaafc89569eae95104a8a8a4826bc2c2cfc3640fe1e6d92f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514541, "uuid": "1ab2a624-8cda-46fb-970d-17d2a2ebd15f", "value": "T1C7150100B7A0D03DF0B751F4797693A8A92E3D91A72494CF52D627EE63306E0ECB5356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514541, "uuid": "f9da72b6-89d7-408f-ad26-12ec6b02078b", "value": "7e4b40ca154bd059f7d22ed12b0ce64d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514541, "uuid": "156c7f02-370a-494d-8f45-17588de6a43b", "value": "12288:tH9wsSr33IRRNJiy9e5j79n8tYeFWEe1Z5cjknBeUbjx6W:1g3mTiyIh98tYeFy3efe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514541, "uuid": "4ca53be1-912f-4570-a88a-ddbc151115b8", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514541, "uuid": "e2320abd-ca4b-44b5-a087-c7bcb1f08db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514541, "uuid": "0582f3f7-cb40-4f26-9915-144b9dafbdaa", "value": "ad6bc29d95755645224e1e8d4bea120d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db01a793-12e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659500535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500535, "uuid": "e942915c-91be-4faa-93e9-dd498559a222", "comment": "Malware payload (AgentTesla)", "value": "cfc1347ff409ff3e611e5a0afec6ee61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500535, "uuid": "1f23176c-5d67-47ba-9511-73f363874058", "comment": "Malware payload (AgentTesla)", "value": "b13c1856b4a956238c84b39c551e6f9c1eeac4733420c060afc427521c9a58b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500535, "uuid": "246b931c-3a69-4d26-b7b5-b57cdf907b09", "comment": "Malware payload (AgentTesla)", "value": "0fbb747c375fa4641a70a8cad23224adf5d31704", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659500535, "uuid": "f76704fa-6565-47fa-977d-ce82dee527ef", "comment": "Malware payload (AgentTesla)", "value": "71a006342bb0f7d859160eb3fc477b68d1742e2d1e0b126b361c97e68a4ee802bc73b7fe21713c0702f7779a85f0fd74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500535, "uuid": "8dabe4c8-ad62-4dc3-bb70-6544b899414d", "value": "T15305F10173B48B07E47A4FF1B5B480545BB37A6AB022E35C5CC934EA6DB27434A5BB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500535, "uuid": "946d4d2b-14ae-4653-ad5c-b4ed4963cce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500535, "uuid": "0e5ba765-16cd-43ae-b43a-20170c42fe99", "value": "24576:mVKLlpxk0SV9vQ8O2SB7svPcBL+g8WU3:mkjSPI83v0ph8v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659500535, "uuid": "b5eab063-5238-4271-9a45-3d84e8491619", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659500535, "uuid": "04c43797-f670-4fc1-9252-29be2e08098d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659500535, "uuid": "a2348938-ccfa-41bd-b1cb-917fb5ce84a5", "value": "Statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a78804-1341-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659540944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540944, "uuid": "921487d2-158d-406e-977c-056852a61655", "comment": "Malware payload", "value": "7d1a0b5b204d10b45c8667a1ce05757e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540944, "uuid": "43cf5706-73ac-4984-960a-146652db90af", "comment": "Malware payload", "value": "b1642ae85a6555e1cbea22d55ef6574f09fcfc5a7c10649253ef43d35a2b97db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540944, "uuid": "2276134f-9ad6-4441-a972-ad450c1dfb82", "comment": "Malware payload", "value": "5ad315df508d60c5a8f5bdc694e52e39b603d9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659540944, "uuid": "a9ee278a-5899-4e7a-b429-a06c4845210b", "comment": "Malware payload", "value": "6ac28f9f66e36b823a693b876251165dc59aaaf0e74a8b7639d492d942c1ee3f495c0e6d391b1f08eb21b20c3558d47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540944, "uuid": "99607906-6aed-4cd1-b03a-057d79a874a9", "value": "T1D445D09172A59A27C46E47F9A025460C53F4F553FB83FBDA5260BAE86CF33528E042D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540944, "uuid": "94565dfd-ffb2-4f42-821c-883e10e61a87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540944, "uuid": "b1269ca5-1914-4267-97fa-6ad15de6d260", "value": "24576:bGGy7HVErY5iBKV6HdYMnPQjwe4H7i2SQFXfD/0:KGy7UHOkJHgCD/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659540944, "uuid": "cc9916aa-88ed-4c6f-bde4-004b71aff4aa", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659540944, "uuid": "a38a1179-a585-4898-9cdf-507d2ca0da93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659540944, "uuid": "014d7a45-ba79-4f35-a97f-06f919e477c7", "value": "PO-Al-Baraka-Group.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49a1586-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659522885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522885, "uuid": "e18e2bbc-1540-4bc6-b851-3fd509842f7e", "comment": "Malware payload (RedLineStealer)", "value": "47b28fc4d8b5df8f6e20edd85c29a19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522885, "uuid": "5c6baffc-b104-4d37-b9a4-a7722bd401ac", "comment": "Malware payload (RedLineStealer)", "value": "b16d87c833f7bbf549d029e5b329dac9c7f2d721396e568f81112775c42f6615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522885, "uuid": "64d7de67-f23f-478c-90b3-8087ec685f6a", "comment": "Malware payload (RedLineStealer)", "value": "dec79a277d8187618d4760fbce61faeda2fc56f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522885, "uuid": "65ae284d-eb88-418b-9931-f90c99897819", "comment": "Malware payload (RedLineStealer)", "value": "1b4571a2a3a64e92d4f53a370bcf1314ea5b9f433ef386ad012074aac839948bbd76e99f22e3db7c9c10092f57c6728d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522885, "uuid": "a19ae38e-5e32-420b-ad1a-3331f386c68b", "value": "T14515488666CC00D3C45DF930CDA6F7299227EEE56B03DC2D2D0CB9C5E57264698B386E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522885, "uuid": "3637dd3e-80d3-4a38-87f0-c1f29f3d69fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522885, "uuid": "81994baf-7447-4f37-b315-52104da9ab98", "value": "12288:xTqnZTxm9CoIYJ9JIF1i8HeXQx2L7iOwWif:xTq5x0/JIoHiO/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522885, "uuid": "633936f0-ca18-4b59-a688-27d2247c90e0", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522885, "uuid": "09bcd515-39f9-44a2-a165-f58842c9a9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522885, "uuid": "1e74a237-c7a8-419a-b5ac-da1108ba2718", "value": "b16d87c833f7bbf549d029e5b329dac9c7f2d721396e568f81112775c42f6615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a681d0c4-1347-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659543397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543397, "uuid": "e5920b85-0182-4ee3-bf28-7f4a45ccb3ed", "comment": "Malware payload (Mirai)", "value": "dc79e7d19864831ca9f02ba5f64b2208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543397, "uuid": "f832834f-f50f-42c5-a50e-44823df507ce", "comment": "Malware payload (Mirai)", "value": "b24817f24abda922995cd7f31a695a0b94cc1f058457262479bdbcff53adb97f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543397, "uuid": "12fd6379-bd2c-43a5-952b-3bcc50e579f8", "comment": "Malware payload (Mirai)", "value": "c018fd44c7d6cac25b5be81067b74a07922e720d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543397, "uuid": "8d2e5071-830e-4c2f-8a24-baf1ecab5f5b", "comment": "Malware payload (Mirai)", "value": "3a24ba62ee3bb9dc103436eeea2829bc3f61dc7a3af06543213237cf60edc6783cfe1963aa9eaecf8ac0f8696510d4ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543397, "uuid": "fa2a2f10-062d-4ea7-9423-ce5e6f6ae258", "value": "T19523F2616940AA10F3B50E32EC2C9687E7C997DCF2B970E13798592C5A935D20EE7CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543397, "uuid": "f68f89a5-2ddd-48ba-a973-888d11bb40e9", "value": "768:+W2myW5zrY3m+KDOtELVpuyUEQNIM4ZktwkVlXFbkdzx3y9q3UELMIk9r/e/lQM6:V7d5zrY3mVqtSEyUE0IM4Fk7Fbkdz5nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659543397, "uuid": "66c65daf-3a4e-4747-ba85-e59aaaedca57", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659543397, "uuid": "0dccf96e-283f-4f0b-83d1-3bffc76631d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543397, "uuid": "b3d46bbd-c0f7-401b-9c41-adc31961e62b", "value": "dc79e7d19864831ca9f02ba5f64b2208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d075f224-134a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659544756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544756, "uuid": "67cbe575-4756-4afe-a0ad-0e09f420e794", "comment": "Malware payload", "value": "a1ada1fe2b3eacfae3254f8942819cb6", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544756, "uuid": "c37ebe12-390c-4bc1-a255-515500127f46", "comment": "Malware payload", "value": "b26503c9652c8d7fc354c69330b371133d508566d57b5132636734b8a72dafa2", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544756, "uuid": "3f492e0c-752f-4965-9cf0-8aed1fc2ca8d", "comment": "Malware payload", "value": "c60af72f1644111b642e4c3d43cd03a7bb099a9e", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659544756, "uuid": "9c9f5abc-f503-4f50-946b-4574a2cfcd8d", "comment": "Malware payload", "value": "c0aaf7e50a35cb99837d9b2222bd9a661550b25e0d2804939df45187c3d81ec66479ef3c4b8438a76560e50e4bb655f1", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellUploader", "colour": "#06A5BE", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544756, "uuid": "dcf14e65-58e6-4a55-84c6-1c48da297c02", "value": "T10B222D95BCFC10C56817A2B145B4068FA36FDBFE0652397271FCB274291AAB5EF1B408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544756, "uuid": "20d31921-f222-458f-8bba-ec2a1765b278", "value": "192:SIANDNpe+W720DiFVAUnsAHCWzfCTOOOObJIvQvg2A7GeXx592h04iJI52ys5vi8:0NfWmFyiDOb7zANB2h0TJI52F5a2VhbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659544756, "uuid": "da3ae17e-1954-4906-ac5c-662f50a3ec10", "value": 10677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659544756, "uuid": "ca274388-03be-4838-9f1a-c3ef8150f8da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659544756, "uuid": "0c22ead8-cbeb-45d5-ab98-ea2a4073ca80", "value": "h0CBJzk2.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16a05b0-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659514236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514236, "uuid": "04db6cd5-3997-45d3-a2ea-f821ba0221e5", "comment": "Malware payload (Stop)", "value": "e437033473ae2fea05e6a4eda819cf87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514236, "uuid": "db85be85-0a3a-42db-ad83-2716141ccc7d", "comment": "Malware payload (Stop)", "value": "b2c14eaeb6a575095e493fca5f5949edd7bde13be5e70fabed09a0b8e99c2f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514236, "uuid": "7db4ca38-54c5-410e-9a3e-3a5f7ce61bd8", "comment": "Malware payload (Stop)", "value": "2a39740b7d940d02505b789cf8fd972373a25bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514236, "uuid": "772e12ef-bf29-4b82-85ea-dda1b52da5a0", "comment": "Malware payload (Stop)", "value": "f14e4f68034c4871ab5c93ceda1f0cc01657af2dc5c09ef70b0f32d47ae7bdd35e4a82bfebd05c6522e7c2f9960f87e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514236, "uuid": "fef4c19d-af70-465a-b761-a202ed2caa27", "value": "T1BEE4122073E38036DDB226345538EBA05A7FBA6313705D9B73B8167D8E312D16B36726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514236, "uuid": "b40de532-555e-4558-9a8f-de3ecd7d7a98", "value": "7b8da7d62de49809359b378ca66a56f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514236, "uuid": "1128bcd7-1226-4f43-be7a-761998a75f38", "value": "12288:qBqRK4tf4gpe9oqHo5A0i2sA7ZWxj4thMBJwHY+27DbUKz8zmji/zR6Fg8:qoK1gpQI5Af2dCj4vMQY+GZz86ji16F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514236, "uuid": "05fd4be2-e7b3-482e-bcaf-fec06835b1c4", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514236, "uuid": "4a765dd4-a3c0-4979-8a45-f77b3434fccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514236, "uuid": "af568ba7-cd8b-452d-a615-9e57dbe47362", "value": "e437033473ae2fea05e6a4eda819cf87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0626ed5d-1384-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659569327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569327, "uuid": "09e45d8d-98f4-4495-9f1c-6bedbbe41f5a", "comment": "Malware payload (RemcosRAT)", "value": "6fff32675e7dc045c0f0079d92520e9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569327, "uuid": "b629a54a-0d91-41b3-aa74-ab2a6b8ba337", "comment": "Malware payload (RemcosRAT)", "value": "b325e786c12aed333b0f8275794c5538ac93eafff7caeee17c739ce7a56d6635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569327, "uuid": "2d44b334-6e4c-4120-bc67-0cee34eddeae", "comment": "Malware payload (RemcosRAT)", "value": "3087399511da2ae717d1d66bc2731a89e2749189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569327, "uuid": "9383fb32-2124-4814-b56e-40c4a58a3941", "comment": "Malware payload (RemcosRAT)", "value": "c553e79ac731af1b9d873a6d7facbb627c280ba50b558d21ef3f22d78912a82b1b664772dc39225e874b359be78e6edf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569327, "uuid": "ecfce312-cba6-47cb-9fab-43f01727c0e3", "value": "T1EA1512059288DB26E7FD7A74E114F7201370EE81A583E3592B34E5CEFDB73405A22DA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569327, "uuid": "7b5842c2-7cfa-4553-9dd6-1f7cb76ba2d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569327, "uuid": "74908821-b47e-44a1-b585-d5e25bbeb1ec", "value": "24576:IZS6q3NeFXcMUDTW6IFZeScmo9IkAu6t:KVCexcMUDy7ZLi9IkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659569327, "uuid": "457ecb23-fdca-49bb-9dd5-58d96c42099d", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659569327, "uuid": "558a0bb5-c651-4096-a5cb-c7e8feaef2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569327, "uuid": "6c008e61-aac3-4cfa-ac05-1c6e917d7ea0", "value": "6fff32675e7dc045c0f0079d92520e9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66223545-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659539424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539424, "uuid": "5d8c9b45-ee30-4b3b-8b34-c0000e515543", "comment": "Malware payload (AgentTesla)", "value": "ecc668a254b80445f0dd95e62a477515", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539424, "uuid": "18e449a7-bfef-4a60-9357-dfcd7d62666b", "comment": "Malware payload (AgentTesla)", "value": "b337f5e610414ca21df77104f8cac1297633f304a619c3c24191ba3b2a37ab4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539424, "uuid": "eda2a8f6-1462-4b05-8bb3-b25671904e58", "comment": "Malware payload (AgentTesla)", "value": "8e7a8406548971717b562c4039189320dfcea56b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539424, "uuid": "e6dd31af-55f0-4f71-8748-2e200d3a1c32", "comment": "Malware payload (AgentTesla)", "value": "c46b7f9bf60636d79c75725eec576b70736024d92d10e4c5886ed00e0872cfdbbb14b2a242066099a61eeab4c7bf8e70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539424, "uuid": "c11539ba-0b77-4f82-9ef8-e62dd8221661", "value": "T18F25AEC0515869D6D1672FB06C36ADB10A3EBEF92220D1083E073AA79973F57265BC4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539424, "uuid": "f00d184e-74f9-4be2-9297-726814d998d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539424, "uuid": "f3cab1ec-a7ef-4fe3-8201-7532ead6d300", "value": "12288:cqg6SKlpxrkhSVOUeKwArD9z8pbHb6sDUC5YCKUdxQ5ne0qL8Ce0Ga:XLlpxr+SVOUh4JHWlC7NxMfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539424, "uuid": "339f42c8-27d9-427b-b7ed-f1732b247607", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539424, "uuid": "79ad6246-4372-4aa4-b803-74f06b58c94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539424, "uuid": "9d6250bc-6a31-4181-a695-33763ba1acc0", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7912a289-12db-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659496935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496935, "uuid": "2f97d25f-ead2-410e-8575-3afd098c2367", "comment": "Malware payload (Formbook)", "value": "21988e1671632c4c38dbce2b0ee1edba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496935, "uuid": "187cf57d-1f7e-436a-91c9-07882dfe3ba0", "comment": "Malware payload (Formbook)", "value": "b4445507807b1467d4c8b022a69ccadbf404afcb5fe68fbf417b2961f414021f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496935, "uuid": "d7ef9e8c-3a2c-4b90-bbd7-50c2b9151a71", "comment": "Malware payload (Formbook)", "value": "5c561a0fb930cba3ff3d4200742e0442e0d698d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659496935, "uuid": "38aafc0a-f0bd-4b9f-95e2-04fe8e8b64bf", "comment": "Malware payload (Formbook)", "value": "b6055509377695cb95aad79c61af9e91dd3a34985de6cc29ba3226fb3e7bba988b634e12dfa9663d7410a7c869ff9bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496935, "uuid": "46fe5585-2d49-4a2e-9e5c-b5bef02761e8", "value": "T15405F06421A55E7FC87A25F8A281640047F140617996EFC88DDF7BFB9ADA7CB07010BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496935, "uuid": "e8374dc4-5cae-494a-9cad-5bc32d9d5bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496935, "uuid": "355bf384-f338-4b2f-a824-632953882297", "value": "12288:cs0hg6SKlpx4bOc3kHAxjgpYbEHn5c1R0WK34D4sB++xsAMSQ0aIxnm:eLlpxQJ0HA5oSkIu4D4/AMSQ0xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659496935, "uuid": "5ed20ecd-e23b-429c-876a-76c35ce27dbe", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659496935, "uuid": "d451d284-bdf0-4c9a-a692-658e8e22845b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659496935, "uuid": "941d6bb5-a101-4ddd-a661-410548780351", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15560cd-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659507767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507767, "uuid": "45599d34-757d-4834-bb00-ffceb17f16b5", "comment": "Malware payload (AgentTesla)", "value": "4634e220fa585efff47d678281d55322", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507767, "uuid": "6e4fbaa6-0cb7-4c86-91bf-0c1df8e80f86", "comment": "Malware payload (AgentTesla)", "value": "b52602e4a3c6f3b8e0921d70e7a7a3ab45f045e0753ac1738ab9841fdba0f16a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507767, "uuid": "2d530a0b-6991-4b99-b020-090cca292e4d", "comment": "Malware payload (AgentTesla)", "value": "75d2d9cd438e3e5bee84767af504c6cff7241585", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507767, "uuid": "e750a92d-9281-469e-9632-5c6b8d45ce9f", "comment": "Malware payload (AgentTesla)", "value": "d4d9a40a751339faca11dec1870d6717087c93a8527d4a6e3b9a0f1ab5a43735a8d3465afef04ca3106734d8f70491ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507767, "uuid": "035128fc-c4ee-469d-928b-935d57185cf2", "value": "T15863D59C775079CFCD6BCD729EA81C28AA20B477671BC283E05351AC9A4D78BCF151B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507767, "uuid": "da624d90-396a-4d54-8141-64e598c33b27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507767, "uuid": "be60d7d4-a2a0-4836-a5be-1e369c24b2e9", "value": "768:Rbp9P2hW8cA8RcZcJV+Tc6QsxY5GG2pfpmRaznVYnyTeEzloTmEKQroEKgZ1h:IUA8scygZq6N27ms8eeOGknE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507767, "uuid": "75d520f4-0f23-40da-a92e-24a1a96bff96", "value": 68640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507767, "uuid": "03aa9b24-e54e-4264-a34d-209a145f7264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507767, "uuid": "e6d4e26d-3aa7-4950-a02a-ff2d689b37be", "value": "MAYBank-Payment-TT-Slip99484939399303003535355555-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d61dc6-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659542616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542616, "uuid": "11fec440-59de-4715-8cca-a6b8409e4883", "comment": "Malware payload (Formbook)", "value": "e811d796124f9521a38b2eba27c88b36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542616, "uuid": "002c75e8-7e61-420c-bef5-68f62c7c15b6", "comment": "Malware payload (Formbook)", "value": "b6786398b0f14b5012742f9eab35abb93ce97e44249b2df5569f2896eeded7b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542616, "uuid": "a027a2d2-e2eb-4f3c-9e52-a0539f7a62e9", "comment": "Malware payload (Formbook)", "value": "46c8279433340b7a2f7f8c6c2fcad9cb02199a2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542616, "uuid": "aa0d81ed-915c-469a-ad4d-e7d5c31f05bb", "comment": "Malware payload (Formbook)", "value": "a59a7fc1f8c921d2d8cf1ec69047b2b776f04e4791c53c76c84f75c8f0101dc2596e740cb284791cc2a0e40ddc7854c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542616, "uuid": "6ad2866d-e256-423c-bea5-5357f04fa7d6", "value": "T162A44D2C7B462AAAFC2D833859410A25FF6B0E2372C0E9B653CB15CEC74F4575D7489A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542616, "uuid": "6db92934-ca0f-4554-94de-758096e38c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542616, "uuid": "5092099d-a6fc-40d5-9319-936c9fd0e3d8", "value": "6144:2c6MvzqZxE9pocY7wCaDyzpsTPM5lRLPfAuwuSpGMinOQYUU6MRktAhbqqu7:2c4ZxEbocYJzzqPyRLPS1ZktQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542616, "uuid": "9e289af0-202d-42db-9eff-4667a32b3b29", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542616, "uuid": "9816f8a0-284d-449b-b595-4ebc447bd008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542616, "uuid": "37411241-cc0f-434d-a5bb-32c97672d474", "value": "e811d796124f9521a38b2eba27c88b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0a45a2-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542685, "uuid": "bdf74851-9324-47a9-9c1e-77911e5d2d28", "comment": "Malware payload (Mirai)", "value": "cd93a06362b00730a8127cd03d37eb71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542685, "uuid": "f32be07e-a7e5-49aa-a720-f038c37ad0c8", "comment": "Malware payload (Mirai)", "value": "b6a166218522cd84f703c2d32843b741d337c306713c2e88b94029616a9a3fcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542685, "uuid": "79db31d7-3eee-44f1-924c-c76db5715d71", "comment": "Malware payload (Mirai)", "value": "d7b814b41a85b63efeefc8dbda953564bddaa0f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542685, "uuid": "4ae51685-a1a5-4210-b19e-72572dbb116a", "comment": "Malware payload (Mirai)", "value": "aa5501cfdda348a6a7564feda500455ca901b6dd13cdbf489a56b69c1dee439943ca4a6254f089437beb1eb9b0e74dfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542685, "uuid": "b744c0f2-da83-47b7-9525-f2d20e379eee", "value": "T1C482C079B29C6422C670543FCF3D8B4123D785FDA2FE7732611906E4A75288D927E6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542685, "uuid": "d5c07417-96b4-4299-b2fb-4c211914763a", "value": "384:M3MJcxMwYgsO0WyBXLZAJgn1ax6Z1+VLAqvHEBLlxXiWtJqhymdGUop5h5c:LcRYjO0WyuJgkx6cVIVHjcs3Uoznc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542685, "uuid": "0d56d12c-c333-4f66-85d2-e080603e2c9c", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542685, "uuid": "f0e00ca7-f973-47d9-a47a-5d490c195869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542685, "uuid": "7bda3e25-fe43-4fad-b8ab-e38130a20e4c", "value": "cd93a06362b00730a8127cd03d37eb71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd604cb-12fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659510336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510336, "uuid": "d513d953-2612-4c95-ba6d-07d27eb60871", "comment": "Malware payload (Formbook)", "value": "c3347ec464fa2644692b790d7a7591ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510336, "uuid": "894a3db0-09dd-4c3b-88fe-503c75459501", "comment": "Malware payload (Formbook)", "value": "b712bd3701f768525585a570717751d0a360bdadec5d24aabeddaab7291f5104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510336, "uuid": "773be4e3-d8b9-449f-a2a6-05a6b7366f5d", "comment": "Malware payload (Formbook)", "value": "3ad9593233a9278088676df5538a8c7a6c0c25a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510336, "uuid": "7a5c7e8e-26df-42b4-821d-d608b5e7cd8f", "comment": "Malware payload (Formbook)", "value": "c05476b67584793f5740b3b187176ffc88538f5a33cb82e9f6711cb358c75e3b43618d2e8a5614df1c980425a3fa0fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510336, "uuid": "6e06431c-a9e2-442a-b536-54bd2987e866", "value": "T11205E00133B58B13E8BA4FF5A5A084154BB77A2A7123E35D4DC934EB5DB23434A1BB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510336, "uuid": "b61c3190-012f-4cc7-8239-06338c8af73d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510336, "uuid": "74ea25aa-f515-44f6-9525-45509989c042", "value": "12288:afFgg6SKlpxnaVpRFYV7+PG74R/nS9EmrOK3PUMG8nRmhwfbl4Wzk:eSLlpxnMMS04g9BrPcMbohwjl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659510336, "uuid": "d7b31855-0d0a-4396-bf8f-c0754f195e13", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659510336, "uuid": "61151058-06a0-4c36-af41-f4750c2f0ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510336, "uuid": "4e45f6cd-b35b-4ca1-a827-71342709b3bf", "value": "SecuriteInfo.com.W32.AIDetectNet.01.2734.13375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2181da7e-1355-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1659549187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549187, "uuid": "4a8836e4-4e26-43a4-8d6f-db649e6b14b7", "comment": "Malware payload (NanoCore)", "value": "14b2132d5a30f91278dc7bb5e624e364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549187, "uuid": "baa113aa-5f38-4f60-97a3-4e1c92a225e0", "comment": "Malware payload (NanoCore)", "value": "b80b496fbcd8fdc4e6bc183162a25e530bf8b2ed8b8adf5ea1285159527942e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549187, "uuid": "6353bcda-6f08-45c6-8882-31c925c8f83c", "comment": "Malware payload (NanoCore)", "value": "9a22fb716a4cd3b788d76fe83727b7f72f88bd7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549187, "uuid": "4f644223-04cb-4db1-93ed-b0fb84d7f7a5", "comment": "Malware payload (NanoCore)", "value": "88febbf3787fcf65f4be391e0830fcf7ab3babef09b97700541d345acb160eeca533dd2131e24aaf99513b8d08e3ecee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549187, "uuid": "b7fd5d97-534c-4221-8f56-99a7873c5fc0", "value": "T1E405E0841357AF37F0397BB2B15590082B71512D90E2E2698EECF8EE69B1B5309F5B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549187, "uuid": "62da0031-c6df-4cce-8fc2-ac2a03d10339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549187, "uuid": "c5932b86-d5ea-4bea-87cd-4c27a4d42bed", "value": "12288:CJYbSgg6SKlpxr2iN8NS+1oGeP6/2vU0USuVsoLfaiuL1xUFzZ0OCQlKU+:OSLlpxr1j+mZy/28nZK25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659549187, "uuid": "9eb64f66-10e3-42ac-a6f3-5163edba6f76", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659549187, "uuid": "c8aa1257-de57-4e04-8481-5da23a6f2f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549187, "uuid": "3804175d-2e47-4e35-bf18-ff1111e7bfbf", "value": "PAYMENT_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6a9709-1351-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659547754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547754, "uuid": "86ec020b-3551-43a5-b6b7-424e2ec320c6", "comment": "Malware payload (RemcosRAT)", "value": "381174065c50d595ce1655c6ff6da73c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547754, "uuid": "3f468d3d-84f9-4011-92d5-307aba69bee1", "comment": "Malware payload (RemcosRAT)", "value": "b835148de603d2b447a2dbe2212a2457e59146e7fc059e27f2a802c8fcb4f7a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547754, "uuid": "6e2c384d-a626-452b-b1a9-d0bcbef2a306", "comment": "Malware payload (RemcosRAT)", "value": "95b87d2e1e144703b6b91909cf6eb74e0487b4e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659547754, "uuid": "0bd8dd01-57aa-42bd-9bcf-822f6805510f", "comment": "Malware payload (RemcosRAT)", "value": "6f3c63c312250e58eda85252d715148c5184d1958ae2e0113fd44e1826552d12449473b16abd8616a3c2e262600ddf72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547754, "uuid": "995d01bc-cb0c-467b-9773-9d21936703be", "value": "T189A4AF11BAD2C072D57251340D39EB35DEBCBD2029358A77B3D61D9BFE30180A72A6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547754, "uuid": "025a2c18-f895-4443-ba1f-f652bdb5efcb", "value": "a7296afab03588778ff3a4f804abab68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547754, "uuid": "ae03c17b-22ef-4d3e-9f22-817c2dd3c757", "value": "12288:wsrjeS3UVprYfELtx6uz6s3Q4KsfZVOtS6d:dHeaUVxYVuzB3hZY0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659547754, "uuid": "75df958b-c300-49af-a2c6-e7dd4a17752b", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659547754, "uuid": "1d1d4ce3-c648-4bcb-8221-850da272a993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659547754, "uuid": "c933b366-09e8-4cc4-839b-7985c68cc02e", "value": "381174065c50d595ce1655c6ff6da73c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e7a81c-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659507617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507617, "uuid": "93eb1c59-5a12-487e-871b-8da2138560b1", "comment": "Malware payload", "value": "c8354a549326f344778c6ebe57e3c6e9", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507617, "uuid": "78f3994b-a879-41c2-b1f5-1592b7c14d54", "comment": "Malware payload", "value": "b8c1ef5da202475f7113c36a014ebeda72a235c4ed16b2ba0244ee95c6e44053", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507617, "uuid": "8008e4a6-2b21-4ea0-962a-7260edd9d72c", "comment": "Malware payload", "value": "ee43d5e2339510e5df738407fab98d4934b8e8af", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507617, "uuid": "f1e258b4-cff6-4cf0-9141-284872f175ae", "comment": "Malware payload", "value": "4b6bbee351cc44bf9b54ead17022ea3512964d1247a7ae959720eaa82fbaed8ffc744fc4440bbcb069a2da0bf1d6ee1c", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507617, "uuid": "6e396dfa-9e8b-47e2-a1c8-5a7b8b43962a", "value": "T15615191BF76344EDC67AC17086679372BA70F82546316A3E2F55CB312F21E605A2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507617, "uuid": "2b2aea0b-bec2-4879-9632-3e86aec02244", "value": "c3af21bbc005d7817532ba12b695386b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507617, "uuid": "a296acfd-19fd-4a9b-bd8b-cd076593d648", "value": "12288:dovsVlhFS1WtJP0q6YSZ7V9fVmKSH1iSka:WEVlhF8WzPvSZB9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507617, "uuid": "69af0704-7280-4554-8683-a6ecd190dc32", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507617, "uuid": "8fe7aaee-6c85-4cf7-9396-ae79384996aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507617, "uuid": "baf62fb9-4669-4790-8432-edf352b7c0d7", "value": "quietmoth (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a006c976-1338-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659536944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536944, "uuid": "a4c1186a-5d87-4d8c-a15f-981e56800c2f", "comment": "Malware payload (Gozi)", "value": "468042278a3e4841d3e33ccca10d99ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536944, "uuid": "18b2a530-9927-4326-9226-117fbdd317c6", "comment": "Malware payload (Gozi)", "value": "b92e9e2c758e32857506f9472cc51aec4b499afa6f703f7c40218e4e4258da86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536944, "uuid": "45f6849c-39fe-478c-b905-b475e415cc04", "comment": "Malware payload (Gozi)", "value": "22532f37096a200d448420359c01bbebaaf6b820", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659536944, "uuid": "302f88b8-cdb6-46c8-8e58-89298fee57a6", "comment": "Malware payload (Gozi)", "value": "ed0588524641295ef68e11ce0e9668b6918d964c131c12e8c6d5e217fb25918ec1c70eac0ff1ee5c3f746306a0f8619b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536944, "uuid": "67f81270-b402-4521-96b7-bb0ee414afdc", "value": "T1AC749D00B7A0D039E5B312F4B97A83ACB52D3EA1A73415CB52D52AEE57346E1EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536944, "uuid": "9b1485dd-4948-4930-8dd3-f56e85cbd941", "value": "7e4b40ca154bd059f7d22ed12b0ce64d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536944, "uuid": "6d7bd9a2-abf3-4c37-9ebd-68e57b13e3d4", "value": "6144:Kjz2asveiXo2K6AOQXMwYIK3IV7l0doNn2ay964atVFtr5n:CzErXrXHQX9YIK3y6d8n7y9+75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659536944, "uuid": "39f67221-0a5a-49e0-b86d-504e2f39b0a1", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659536944, "uuid": "2293116c-50b0-4c2d-b019-f2230ea78572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659536944, "uuid": "dd296235-9629-44cc-be56-f8ed9a80b596", "value": "468042278a3e4841d3e33ccca10d99ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da1cd15-1380-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659567622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659567622, "uuid": "ad823d42-ba30-472b-a7e1-79d2669f8659", "comment": "Malware payload (Stop)", "value": "2525a3320e00d6c91bd4a62d33c7a007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659567622, "uuid": "6d5f2a9f-fec5-40f3-9592-57e94ac849a0", "comment": "Malware payload (Stop)", "value": "b951f1f122fd93b6473f076192a2cd48b3e875df347b7d58e5471756e6d4b513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659567622, "uuid": "40a85574-b59b-4c33-bd7a-63abd0e63a77", "comment": "Malware payload (Stop)", "value": "f7146efad9f6f4bf7ccdcd06db83d24af6cdd7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659567622, "uuid": "5e14b84c-afa8-4239-a875-70ae5418c2c7", "comment": "Malware payload (Stop)", "value": "68280059cc4e521ad03472be9552bab3562b57833bdf4053f34da08bc70d7c2f969047392db980b389057c8e2f29471f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659567622, "uuid": "be6f7077-a157-4243-bf41-77f454b471b3", "value": "T1BFF412713AA0CC32F1673730DC668EA05BBEF8215A715A4F779817296E757906A3430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659567622, "uuid": "fef848da-866c-42b9-9594-90faa7ac74e6", "value": "b17c65b0a8ac01a9e7c26566c998beb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659567622, "uuid": "24802ee7-7963-422b-a2d4-751e8e8d281a", "value": "12288:idQ8ubqYg0p+f9szwLQ4YQ6wFFDGeP/oMPfx3OJ+kw5uSGzIQXDDr0sipF:id3gqt9szwZ76wFFieP/HPfxtYXwssF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659567622, "uuid": "9559f4c9-254f-4586-b07e-647254d4d433", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659567622, "uuid": "06603109-2e79-4871-8847-60a50283473e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659567622, "uuid": "3351ef95-26fb-4a3d-813d-3db12d338810", "value": "2525a3320e00d6c91bd4a62d33c7a007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5a0678-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542654, "uuid": "239f6399-4427-421c-82d0-fbe940706981", "comment": "Malware payload (Mirai)", "value": "cb07b9df159163723978e7020c247a30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542654, "uuid": "392d4c60-495d-4596-a977-7cbc9effedda", "comment": "Malware payload (Mirai)", "value": "b953ee39eb2b0c47fb9a7c6dc19040ea5173e1fa497e6039ca973cd868612c35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542654, "uuid": "77ef41e4-7da7-4460-9d2b-d6849dc3d51b", "comment": "Malware payload (Mirai)", "value": "6dd2245c8a86966ea97b882b99a0137fcc08d7fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542654, "uuid": "f70110b8-1c8a-4a78-b74e-55931af9f8da", "comment": "Malware payload (Mirai)", "value": "11d9fa35fd0c5349ad1bcba858b8a17189e8939e94e196223671f1c66dd67035333d6648044525433ce2aed5db0821ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542654, "uuid": "f3f46da3-7461-4a57-91c7-b945a70f0770", "value": "T118A2E019BF1C458BC936393942D9E9C622A1EC71F3ACDD4A5E90C0AFF5A33956034F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542654, "uuid": "5b13b6f6-88f4-4add-85b9-9c5ba61fb936", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaz1Hb+502F2vwA9B1fKVVXUSyu:x98o08kxofBE+ZkXaVbp2F2n8VVXgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542654, "uuid": "de1db848-018e-4f5c-85a3-86a03eaf2967", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542654, "uuid": "70861c0d-9f09-4e22-9e11-0894fe146c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542654, "uuid": "105b3a99-c51e-4e13-8398-e4af4836b8b3", "value": "cb07b9df159163723978e7020c247a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fae64f-12fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659510909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510909, "uuid": "baa278db-48a9-4806-9aa4-3c25dc30328b", "comment": "Malware payload (AgentTesla)", "value": "a4ebcbd32e252eb6d00d54e47f1c84f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510909, "uuid": "60c0ed41-079c-445b-b3fd-c0de35ccbed1", "comment": "Malware payload (AgentTesla)", "value": "b9b3d2e08274b34bfcd07fc61c3b399a4a75aa436ae61be2d8576349e4788f37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510909, "uuid": "23853430-5652-4aab-9964-0aa1128c0f52", "comment": "Malware payload (AgentTesla)", "value": "7c23e473709c1b4cba4abcf0938052823aac6b1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510909, "uuid": "fec91c40-aa9e-4cef-9305-d45641a0a7fc", "comment": "Malware payload (AgentTesla)", "value": "d8218c6ebdd1b348720a6ef00f556eda8268785dd60649a07588c0a5eeaf7d17b69196055938b4ab30febd062f29b9eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510909, "uuid": "a297ece4-4ba9-4a5e-ab17-cb3cf8c725bb", "value": "T1BD03F1C43464C1CE4F7CB2B7FAC4D3A86719BE1A1D7B5B066768BEA21596012DCF2390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510909, "uuid": "138d39f1-0f14-464e-b1fb-b61ef1c3a575", "value": "768:/nq3oP6/M7KB1r89RyIVMlK25KFLsnWxczX1TGQvmKIV+N5j2jfr2ie:/mID781SsIVMYAnWipaQurV+kaie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659510909, "uuid": "07c10f0a-1f47-43fd-81ea-3601f1a36f04", "value": 37984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659510909, "uuid": "5d4a396a-696c-4ef8-9b56-599b0eb01d36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510909, "uuid": "99f0683b-0a12-44b2-8eef-496b25d32a7b", "value": "MAYBank-Payment-TT-Slip99484939399303003535355555-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9639ffd4-12fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659510298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510298, "uuid": "ba0a3dbc-8d24-45d7-96f8-d04ee57b901b", "comment": "Malware payload (Formbook)", "value": "4046f4745687049722842f4c1e0297e5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510298, "uuid": "668afa30-582b-476b-80b1-ee4627a6ec9d", "comment": "Malware payload (Formbook)", "value": "ba16c28e3fbc8eeb09792f04fb82a3fbdd0f5ea29d507a3cbcd37e28c6bea5e3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510298, "uuid": "a65e2184-1429-4513-a28f-070411b673e6", "comment": "Malware payload (Formbook)", "value": "407995ac33bb22358bb0b65bc1c6960341640dc5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659510298, "uuid": "bdd813c2-ea2a-4e79-a0b8-c6d4e8762a31", "comment": "Malware payload (Formbook)", "value": "d6e18e9c6a92cc405af96981eaa5fc0dacbaf5c905e6df4989578d2507656440eb709e8e60e4a874553f69de9398ddec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510298, "uuid": "bbf0450b-0efe-4cae-9d76-fe806989b0e5", "value": "T11CB4231053AA71CC9F07EFD7392B035486DC7547D188316A7EB602AF1621AA7FF65903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510298, "uuid": "6af9202a-6f8e-435b-a0fe-63fcbea20819", "value": "12288:uqVSp2i8Z/LRoXtu7O09zHXLF2944Ok+eGse0x5Lk:NVSp1O/toXtWfXRw4hk8se0xtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659510298, "uuid": "77d88a6d-3df7-4c26-9bce-384edc21b12e", "value": 509349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659510298, "uuid": "4d57cea1-1805-4d73-b458-c75b4656a143", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659510298, "uuid": "e59c8d2f-ce10-49d7-84c8-b8420833e33a", "value": "SHIPPING ADVICE#202208.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d235d125-12d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659494078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494078, "uuid": "134977da-9255-4114-a580-8161da3435d9", "comment": "Malware payload (Mirai)", "value": "1a416db859e67aa54040315e7930b136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494078, "uuid": "62d23f92-2e00-4f02-abe9-b255fc0bd0d9", "comment": "Malware payload (Mirai)", "value": "ba5d615bd9ef1a5acedf3ffff21d610d7b2be96186ce1bf7ca34b57c17f35ebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494078, "uuid": "191cb058-6d3b-4ca0-89b5-126869f66f30", "comment": "Malware payload (Mirai)", "value": "5a01b542650f31632e51a904f2009dee501b983e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494078, "uuid": "2de96859-e9c5-41cf-8b36-947a6c46db50", "comment": "Malware payload (Mirai)", "value": "f691eda08da7b62ec056728a4e2a1429e8a1d439f3f941af521f173584454fe0ae42abdb2e239166bf540a4612971e0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494078, "uuid": "42f2009c-ad9e-4d65-8c92-70e5f073f711", "value": "T14AA2E1FB74DB0897CD66D8BB012E08DA446E9D2503FBC7D23AD171B25A63098DC3AB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494078, "uuid": "6470a900-4aeb-4872-8af3-64716ef0561d", "value": "384:MEcDqRfKUWFH39z+/49ETjvXOtTyPq1KLLjlu3gd2sTjDglBi+v1RpA:VMkKJFH39CBLOtTU6Ujlu3IQdpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659494078, "uuid": "edd93059-1168-4213-85d2-5a7d863a4692", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659494078, "uuid": "dd891889-a3cf-4609-8ee6-3a74b73d866e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494078, "uuid": "b7143ad0-c68a-4a2e-b8f8-177c9d3228fa", "value": "1a416db859e67aa54040315e7930b136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c3b9d4-1342-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659541144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541144, "uuid": "cc3a2ebe-21ab-4981-bc95-d3075436a055", "comment": "Malware payload", "value": "cbab091d7de15b7cb157c9fb721f1813", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541144, "uuid": "1ce7f611-dcdd-4866-80a5-58ce3edf84d6", "comment": "Malware payload", "value": "bbe3b9175095f0942fbcc4d2ebfef68b972ccf9f22cf52012a3e31eb498b4091", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541144, "uuid": "a1fe9b40-62ff-4f99-9366-4622fa7ee4d2", "comment": "Malware payload", "value": "67b454d3dbc08dff88fd8d905bcb09f752ac2290", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659541144, "uuid": "2d4dfd77-a4ef-4045-94f2-8431647e3752", "comment": "Malware payload", "value": "2001e57e97bded7d8b3ee0e568aafbd02a13c3aa5ac48cb54fd65adadcf4302606bd0f016bfc93f8e3da64b7d6e2b9cd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541144, "uuid": "f2d441a7-c41e-4db4-8583-066374372b07", "value": "T1CCD2D00D541EAEDEC8AB6C3EAC1C0EF88E5C4181D50179AD6D15FA7C2B867C2438F5DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541144, "uuid": "77ea1e6f-258e-4783-8863-54a63c267375", "value": "768:Y1/KWuHsyS5JgCF0eczcoJ1mQG0LfT/5Saw967:YBsHS5iCGFzLLdi67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659541144, "uuid": "639f40ba-09b7-4b02-bbff-d7ce0156cc5f", "value": 30060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659541144, "uuid": "a392aee4-7aca-4e85-bb93-db8c571ecb8b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659541144, "uuid": "86fad9b3-4d07-4807-bff1-45877844132a", "value": "4_202208501119555808.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91186681-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1659539496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539496, "uuid": "3ec15d48-9199-4636-b53c-76c17d200aaf", "comment": "Malware payload (NetWire)", "value": "8d716616f6251eb501301a7ae6adb281", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539496, "uuid": "301900ef-b958-4e0e-8c32-b6faa4019995", "comment": "Malware payload (NetWire)", "value": "bbfbad35286bd453c139ad4e1a6361072509fd878c9583f2b4767cb2bbb9fd54", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539496, "uuid": "6156d7cf-511a-464f-9aae-2fe1fc357e58", "comment": "Malware payload (NetWire)", "value": "f77a1b8fee85dc4a268ac4ec84a72d7992849266", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539496, "uuid": "ffffc0bf-3f69-493d-a7d1-ada8efd11a99", "comment": "Malware payload (NetWire)", "value": "f735a7932cab99164708ccb54a7ad590542d279b149356b74d50a925c4eec34962ae71194e0091b91e6c3f7e3c3bca69", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539496, "uuid": "1f53ea2b-c4a6-449b-a0bf-a842a3e5c526", "value": "T1D9945C229B44BB5DE2946D5FE07D0A5E21F30B84C4A2B3CD6363B50B66FDD0C6B2961C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539496, "uuid": "d593ddb5-df3e-47ff-ad99-caab468fa136", "value": "6144:o3aCVVNDUybivE3oTLN5vBoJEz6na68uNb6WcKQYnYyzHPNALn6uX:oKk73oTLNtOJEf686bBr5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539496, "uuid": "a8635be0-4f36-4404-b9a0-a37102fd01b9", "value": 421311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539496, "uuid": "4eccf006-0aee-4835-bd2a-2d5384654d99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539496, "uuid": "0fa3d3f6-1092-4a8a-9308-228788b7903d", "value": "Quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd76d912-1353-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659548697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548697, "uuid": "e998a803-a827-4de6-a724-7003d65eb866", "comment": "Malware payload (RemcosRAT)", "value": "f61c74deae0ce023bf2231e030edb7ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548697, "uuid": "3d5eaee5-a73c-4d78-bfa6-807072f73038", "comment": "Malware payload (RemcosRAT)", "value": "bc6f494da47a6a0d914d0accb1e3297610a32feae6927160a0997434f75d637c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548697, "uuid": "fdc4fc6c-3139-4a84-b50e-719ad52a45be", "comment": "Malware payload (RemcosRAT)", "value": "895d1f61c833447a0db9769679e05594b766fa1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659548697, "uuid": "849f3759-8bd0-4286-ae3e-ccc709fe45c3", "comment": "Malware payload (RemcosRAT)", "value": "4490f159f125e64ccf23eb09fa51109a335ec5917e0e4f0f0132689be782d3e4c82944593116dca3e49f7bb2ebba44ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548697, "uuid": "da34ed8e-f895-42b6-8326-195ab12a282a", "value": "T1D9A49E12B8D1C032C17222700D69FB759ABCBE20293545BB73D92D5BFE711D1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548697, "uuid": "a19ed604-30cc-4cda-87f4-eb7fb72134b3", "value": "409f5d6d64eccf1b9873a7c796c3f1ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548697, "uuid": "0b4c68cf-5211-4f58-bea5-bf7272777c29", "value": "6144:Mc53ezqVrhiBZ84M/k22nZcrTEfCNV0cjd2shWR5dhTAOZZ8jXCSrcDzu:353ez1HzMc2k0EKNV5dlE//Z8eSIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659548697, "uuid": "36f0655a-a64d-4ff0-9148-9ffcbed0fcae", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659548697, "uuid": "d90bcb93-040e-4784-9efe-2d553f627b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659548697, "uuid": "3f791b54-3146-48e9-9a8e-237e36e98c2f", "value": "f61c74deae0ce023bf2231e030edb7ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7906977-12d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659494087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494087, "uuid": "2a6d8f7e-7e50-4e05-bfeb-e1d7fab7ffbb", "comment": "Malware payload (Mirai)", "value": "5de47bbda958eb3adee27de9a084bc13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494087, "uuid": "0cd9fc45-28d1-4d3a-82f9-bd1f4e9c27b9", "comment": "Malware payload (Mirai)", "value": "bcf6856f9bccbe909890c303dc68c61d3d7b1b26a42c6ed5f25f4b71e3bba669", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494087, "uuid": "43d24e06-07eb-491c-9f55-6588e7bfa507", "comment": "Malware payload (Mirai)", "value": "0ea44b909c8983686ae080e021535c4033c0e985", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659494087, "uuid": "f9a3a1b2-8934-4942-b0c6-627f30e1cd67", "comment": "Malware payload (Mirai)", "value": "aaf45d4632538778a68832553bcdffc9205c282f3c1cad68cb2cdff1836287d567a247e60b8f5f136b9310fdcf964eec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494087, "uuid": "6b4a6afb-4ca9-4bdb-bab3-122c5eef27d6", "value": "T1B4B2D03D1B161F98DE1AC0BE839D0B503CB81B35D542AD4A7206EDD39F968B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494087, "uuid": "bbc92192-d336-4203-8eef-5fa8fe631f59", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuikTmdtJgGlzDpH7uNj1JAj:YeD8ZSWvZHZbs1row697qohQvg9kTit/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659494087, "uuid": "0f1ebb0c-3a93-4acf-b519-04440316728a", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659494087, "uuid": "7a406378-ff48-4da2-9b3d-463ef08b6b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659494087, "uuid": "964f19d6-674b-4c46-9ff8-11c6b2729748", "value": "5de47bbda958eb3adee27de9a084bc13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b764ee4-12ce-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659491195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491195, "uuid": "9abcaf90-7b25-427f-bf11-a83dedd5bc72", "comment": "Malware payload (GuLoader)", "value": "c75cca8ddbbc6c6a4bac9461b2cbcd19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491195, "uuid": "85b48331-400b-4e8f-ad19-a516520e3e3a", "comment": "Malware payload (GuLoader)", "value": "c1d412945be7ae627b90fb6fdc3863ab510034e711a0e9309d8b5515d8422cd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491195, "uuid": "307d12d9-d638-40f4-b03a-1a972c893b52", "comment": "Malware payload (GuLoader)", "value": "0b776e75fbad781402ae62c2f8d0c0acb3792960", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659491195, "uuid": "1cebd9d3-a5d3-4c46-9411-8dfede34211d", "comment": "Malware payload (GuLoader)", "value": "f5b12425ed44c4d25c3063222dddbe84bc8c40e6d472eede1bb885e11a743c37f7cc2331d8641813b50d9ee61fbcc1e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491195, "uuid": "48f1c9ac-552d-4f5f-bc25-38badda0a6dd", "value": "T154A3F13623B0C4E3CB2A0B715D762B65FFF6D91804A1934F7B609F5A3D227C2890E589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491195, "uuid": "29d18fb9-acb0-4f2b-b258-858765db302c", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491195, "uuid": "04aea095-06c8-45f2-aaf6-cfe09ea467e1", "value": "3072:/Fi6z/VXzAf3ocLxb31my1JcSQS83KzbsdZ:/xFSF3Sj5rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659491195, "uuid": "0ba5b8c3-5249-4c4c-b88f-83289abe4115", "value": 104936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659491195, "uuid": "c9d9f02a-ef2c-4712-89c9-b3c2a410e99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659491195, "uuid": "a582229b-6e63-4e6c-9ba4-ae8004cfb508", "value": "c75cca8ddbbc6c6a4bac9461b2cbcd19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c069a861-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659514235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514235, "uuid": "28f3937a-5a21-4d49-9b9c-ce3ae946ea7b", "comment": "Malware payload (Stop)", "value": "000a8472a69cdf8d338ab32ba35cb965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514235, "uuid": "56851d34-4692-4043-a2d1-25c9e6e352eb", "comment": "Malware payload (Stop)", "value": "c425fdbc1a11a24768fce96c757b62e9666b5304642f9047b28bf4d3f35ba020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514235, "uuid": "13c57b0b-b39e-4003-8fe4-1258ef7ab9c2", "comment": "Malware payload (Stop)", "value": "fe4dc22074a51aad8dd992271e3c19a462bb0b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514235, "uuid": "9e9b5c9c-af88-4114-b9b4-ae0f1a3741d9", "comment": "Malware payload (Stop)", "value": "7def1b51a461b998ca62376b3a5d6f6e980945fe15a5c2de7c89e0409c7c93d238e3af1c1802ccb9eebaaac564accb91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514235, "uuid": "838183cd-9fee-464f-8595-890781a1944f", "value": "T176E42220B7E2C032C3EB6930B860C525217BBCD597B4A88B7764572F1F61AD06E747A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514235, "uuid": "5f8f6463-1cb7-4e16-b043-5494d8fbbc10", "value": "16efb6b0368de80f5b2f8ee7ed5ecc80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514235, "uuid": "fa3fc9d1-bbd7-447e-80dd-d8f76e2346bc", "value": "12288:ILzsd83KnVl3xYETFQi1ys/kJebRMY/s9xFVbwRH/eEFAxvWf55934L7VwnmBpyf:ILwd82VlrmW23Ykt10H/eEF+vE39ogSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514235, "uuid": "715dbd22-3673-429a-8cb3-64f2f8df8247", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514235, "uuid": "387f7aa3-5da7-4c6f-bb6a-021cb6beaeb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514235, "uuid": "de08dbb2-911b-45d7-96df-2a78bd744cd6", "value": "000a8472a69cdf8d338ab32ba35cb965.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967df603-1383-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1659569140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569140, "uuid": "ad824a1d-8408-4e94-9dd3-894191b6c9c8", "comment": "Malware payload (DCRat)", "value": "45d430e595f8ab8cd49cf5f38ae169a9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569140, "uuid": "9fd95477-9182-4610-a041-df1cd8601fa1", "comment": "Malware payload (DCRat)", "value": "c485f4e6a2850e78efdefcf16a223bd45eb31d906f3b9e2c021e48ca3596fb57", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569140, "uuid": "ffa0ca5c-211f-4195-8d17-2eefdc3ce671", "comment": "Malware payload (DCRat)", "value": "7c00ff8b79eee72acd8e8200c097a0950bc94396", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569140, "uuid": "3234a5ea-5401-4b7c-9489-c5626c6259f4", "comment": "Malware payload (DCRat)", "value": "260bce7b74e4903b198700f969b068990f19ced64e211218b963d6cd4e9b7deb136bdc01a62f4da4c21bd54a8704bd3f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569140, "uuid": "b227a6d8-3aa7-46f0-85c0-5f258edfc7f0", "value": "T16C75AD177A59CE12D0690733C4DFC00883E8AD82AB66DB5ABE8A33AD15613E71D4D5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569140, "uuid": "ca7b5780-0320-4db8-8144-22a4f4588999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569140, "uuid": "55714619-a6f8-47ff-b252-e6e270e3fab9", "value": "24576:eXGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:PqVNxhxFVKQKHgk5RmVKG7dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659569140, "uuid": "946c5fe1-36dc-48bb-a508-c3fa9d15b413", "value": 1693184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659569140, "uuid": "8357257f-6697-4d7c-afbc-609b5a065627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569140, "uuid": "b0ebce65-df90-490a-975e-cdd32c413d80", "value": "45d430e595f8ab8cd49cf5f38ae169a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e9aa27-1306-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659515266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515266, "uuid": "a19ae7f7-acee-421e-a675-7ff91e957e05", "comment": "Malware payload (AgentTesla)", "value": "30209d842ac31b2be62f8413ae7b99c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515266, "uuid": "8b6fe7f2-c198-46b7-8b81-18805629f227", "comment": "Malware payload (AgentTesla)", "value": "c656cd0f60e4930844184edd938caf956f79878500ad958e960477f702e07f45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515266, "uuid": "6144c3f8-27dc-435d-bf0f-f8e64757d0a5", "comment": "Malware payload (AgentTesla)", "value": "958046ad147a07c79ff0955cd87aa45011c8b9b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515266, "uuid": "a6ff9b85-6681-4a31-bf38-896679dd3f37", "comment": "Malware payload (AgentTesla)", "value": "8ec587231e4789444a0c4d81f2ef40302b12917ea2680dd3bbdbf9d8659671b5b04f3454703ded044aaffe81a6183200", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515266, "uuid": "ea098a31-e248-4f82-9ed8-22e141888df3", "value": "T15FF412C637FA9B23D4309FF4B12044550BF4512F2922E18A9EC9BCFBA5A97470725E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515266, "uuid": "3fb88e31-84d5-4459-a170-70d98ffb01c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515266, "uuid": "9ec52c28-873a-4cbc-ad77-e390bcb6fc35", "value": "12288:Hg6SKlpxs/bKFPA4U7VRxfqosv33rCmSp3UOWogM7MiGvp9y:JLlpxsDKK1xaLZ1oz7Mi0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515266, "uuid": "1d9b36fb-e701-4eed-8663-2676f84fd366", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515266, "uuid": "ef46e7b6-d8ac-4275-b102-9343b0ddcfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515266, "uuid": "c9b5cf83-f5af-40dc-954e-6381e92d8cc9", "value": "PO-151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e296921-131a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659523948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523948, "uuid": "f6fb281a-5d2b-43f1-8a15-95a1067e0c36", "comment": "Malware payload", "value": "895dd502f5dfcae902ce1cdc9b92da61", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523948, "uuid": "801ffeb2-5e5e-461b-8a06-a1abfd96c804", "comment": "Malware payload", "value": "c7ced570fab80dd904ba5220e86acf9537c262a44a746a26c914a4f4c4239449", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523948, "uuid": "0208b010-c656-415a-b157-81e199078230", "comment": "Malware payload", "value": "480fb89b782ea466820c7e57ee69b296d2da37c9", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523948, "uuid": "f47435be-6a10-4ced-b384-f135e530cd3d", "comment": "Malware payload", "value": "128037efd0f2fad61406a31bee786f4d3607ece16ba659f5a962fdb2384b13f8d208a6c6316ce0bbf2bf7e7fc8842cf1", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523948, "uuid": "0377f802-9503-4df7-836f-6816e1cc4840", "value": "T1D0858D24F7405CD7D42D4376C7877D9827726E628F9ADDCA81B46FE20873B65EE21A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523948, "uuid": "7a8a534d-2664-4e1a-b89c-dd5858410e9a", "value": "6144:Opr+7YE4m9XZS+g38EVs0OT+gieBj+5KalM:Op6h4me11OT+gie8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659523948, "uuid": "65ea30de-7c68-4adc-93c2-bf963d150a4b", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659523948, "uuid": "d3791580-818f-4820-9807-be524c9e48ea", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523948, "uuid": "123d6ced-dc6a-4c20-a520-6e56d5e92de1", "value": "Invoice_184_unpaid_Aug-02.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f61445f-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1659539385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539385, "uuid": "f8b32ac0-710f-423f-a5ab-b5906b71bed0", "comment": "Malware payload (AveMariaRAT)", "value": "60191ee3dc709db7fe482e221085d96e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539385, "uuid": "ee1a087b-109b-442d-bb7c-75cd568db0b6", "comment": "Malware payload (AveMariaRAT)", "value": "c8baa747450184f8b5fee2ad9b1e87bacd88960cc3831cced563da00e00af443", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539385, "uuid": "343b548b-6d83-4773-81f8-c610415b6516", "comment": "Malware payload (AveMariaRAT)", "value": "8db86493b57910831395f0e93d1ff789baca58f8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539385, "uuid": "3a5019b3-059b-4b73-892a-e89140fd6f6e", "comment": "Malware payload (AveMariaRAT)", "value": "bee2394b68650759509be4252ba4eb7ddc8eecf830358dc68d93cd74229a39dc4634085aabed372e3340e391479281a1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539385, "uuid": "2c1e0188-11f3-48dd-b91b-85ff183b5d9d", "value": "T1AE053673D0FB8957F9B295F871E682203E229F10D600D3281196F766A7F9CE997D1322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539385, "uuid": "52025563-0ed2-47f6-8071-4a873a75801d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539385, "uuid": "c04d8856-9b53-4c97-95e0-e418dc467374", "value": "12288:ddOzgktKvnW/TjibR0VqbKJ/OmNiLkgrrS9WNgkM:ddOzgktaWPuKJmSx96M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539385, "uuid": "c8c9b0e3-d08c-42ed-9a54-119a5bf8c0ba", "value": 822968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539385, "uuid": "82147977-9b9f-4d60-8b4c-646307328bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539385, "uuid": "af621345-e0f5-45ac-9697-7b855df906f6", "value": "HSBC Payment Advice^^^^^^^^^^^^^^^^^^^PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d271b12-135b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659551757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551757, "uuid": "932c6850-33f9-415a-a77a-5128b7012328", "comment": "Malware payload", "value": "52dcdc5c68f6e03fdd347836a0b4879b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551757, "uuid": "8daedf94-b7c3-4cc6-9476-103f8e3154e7", "comment": "Malware payload", "value": "ca8b959048a6ee80205f595eed44abd26d73bc3765f967a12cf768a287241ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551757, "uuid": "1e54602b-be22-4913-919f-3a50e26a25fb", "comment": "Malware payload", "value": "beb4fc49cf66fcba935e8ccf929efebf67a0b050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659551757, "uuid": "816d7050-97d9-4beb-b18f-f66d1bade1b3", "comment": "Malware payload", "value": "1704c70650114fcdfe09e7645b13b85f7b9a0b9a0660ef433a9fd0a813fcca0f5323be02b4b1b87b40ad88a9cc695ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551757, "uuid": "0906e610-50cd-4ada-a71c-4c83dab15a75", "value": "T1E4555A4103E4FA78F23A23F6412551448BBA615786B9F60EF9AD31DB0F36BC0A54FA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551757, "uuid": "741bea99-a4ab-4402-89ec-6055fb7024c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551757, "uuid": "139d1c4c-3f07-4fdd-941c-98aae9388d44", "value": "24576:YKCITzOPQHPwR9drMGF0Eg9+O3vfkfmfg+MgxP:YuO1RLRLgG+MgxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659551757, "uuid": "578bde1e-15f6-45fc-b6cc-286bdb96ce3f", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659551757, "uuid": "a200619b-34ad-46ee-a854-d3e1e11af0e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659551757, "uuid": "144ff8f1-827f-4f9b-be8c-43c59eeccd0b", "value": "SecuriteInfo.com.Variant.Lazy.229565.27362.185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc97696-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659511972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511972, "uuid": "cea9f41c-0a53-42b4-9027-e032881d01ea", "comment": "Malware payload (AgentTesla)", "value": "ca265cd4e3e91fb9a4715f1fea278865", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511972, "uuid": "4820bc8e-c0ab-4950-9622-b51796017a71", "comment": "Malware payload (AgentTesla)", "value": "cbdfc228c1140900ade75a13e9d4f2633303b520cdb95db634efd559adf5c18e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511972, "uuid": "579038be-d025-41ca-b1e5-80957f3289a6", "comment": "Malware payload (AgentTesla)", "value": "275fcb556791dec261ca5208dd0b6f8e1a6ac3d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511972, "uuid": "d8f124f0-1a27-47cb-b1cc-9c59bcb7fb33", "comment": "Malware payload (AgentTesla)", "value": "3f9d14ab609a2e16aa68f2e1e5e17362244bd4bf9ace58e826f1ad46daa2c8c9aa1eebf92fec8732f94bb809c792b19a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511972, "uuid": "cc99bc49-0645-469c-9837-7315d27cb240", "value": "T11BA423FF34932D97935F528A514B6DC0A100AC0365D3B9927A93323DE267AFDB1B20D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511972, "uuid": "65756843-7a3c-4d3a-87b1-157b95e26114", "value": "6144:B+DxqZ61aIAWx1Pkun2Gh1M3iYIBtDOtN15hn/yuDBaHCOeCn3KpXXo2Gb7PncpN:IDwEspi9n2i1BBtGRhZtoFvkpnndrY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511972, "uuid": "ab7b8ead-a786-4a93-bcb1-5e980be93df6", "value": 490305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511972, "uuid": "4f70a474-1e9f-48c9-b6d7-4c7fc6efd43f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511972, "uuid": "b971919f-4c61-45d4-b614-93a31a3659fd", "value": "PURCHASE ORDER 121120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b47f616-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522521, "uuid": "6e6d7f05-9bf7-463b-8dca-a74f97b20977", "comment": "Malware payload", "value": "603970554dab581e49be5319259763fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522521, "uuid": "3987ac1d-4912-4f31-84f3-ea2d11767613", "comment": "Malware payload", "value": "cc59f1efcf8937d0b1db54bced8e356b2da132d9d405c53587cc351087517851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522521, "uuid": "6430750e-e85d-43c0-8769-fea1bfaaf4f5", "comment": "Malware payload", "value": "b3b2f95739da8e312afc5f7d8137f9b4a96d82ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522521, "uuid": "904fba61-7f40-4208-90f3-62055a3e677a", "comment": "Malware payload", "value": "95059d05cacaf2c64594b03b3b8b600508630380c1b15a37f80e48d029a0e17ff0588ae2047b58be0b68bd6c95046015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522521, "uuid": "be80a76e-4fb4-49d7-b7a6-7bb8b3c43edb", "value": "T1B0740250B3D0C967FDB90B7258B747A70EB4E606D170DF932B486A1FFCA2351881AB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522521, "uuid": "025ce74e-ff21-4657-bb67-364f981c9187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522521, "uuid": "91f9e881-763f-4f54-ae34-a6a9667d4b13", "value": "6144:AWgad99e+3qs8WYF3ERireK7i740Il+3qs8WYF3EblM28WU9ths+7hUa8T2t0Eyv:AWQuWEMbQ2uWEbWWUVbCLRKEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522521, "uuid": "68f5f0d5-4fc4-4958-9fcf-9568a091dcf6", "value": 358247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522521, "uuid": "c80caa90-9a82-4522-b4b4-9a59ef04e8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522521, "uuid": "fe22d3a6-e9b0-44c6-981b-ba424df3caf7", "value": "cc59f1efcf8937d0b1db54bced8e356b2da132d9d405c53587cc351087517851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0262baf-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659534394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534394, "uuid": "0924e116-cf34-4e8e-8cca-89c63a5727d0", "comment": "Malware payload", "value": "c344a54d33e820eeb2c60ffe65e1eec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534394, "uuid": "d2a541e9-6e38-4147-add8-0718e0789391", "comment": "Malware payload", "value": "cd6625e86e6ef4d5a9893068141052f526c469b5107d2265a22f85b50f7cdf15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534394, "uuid": "604d1dd6-e94a-41d5-9ec5-fb023eef3f48", "comment": "Malware payload", "value": "4cf5eb9839452ae2b2bee7868782f47d481ce564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534394, "uuid": "27be721e-7e82-486a-a865-07fc616c1bf1", "comment": "Malware payload", "value": "e2a58b2b9ad17b2bfd72c6448e30006db32367d01e1fd38e5a049a0b36d9be73e52d7b5b3cb55e571b253e23aece9e8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534394, "uuid": "331e8a79-c201-40b9-a3d8-c890bf1ab6c7", "value": "T135543A55A3AC099EE9A7853ACDA39717FBF27C051250D33B1290DB365F33B2AA538311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534394, "uuid": "3880211c-65a9-4256-93ac-2323e5278581", "value": "6144:dCf08fLIWAYpBJ7TBV16yH8UDfQhTi07imE6G4vvQl/cK8c5dMZ6APA4tiA:dwTAYpBJ7PgyciQh+02mELRvbMZ6AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534394, "uuid": "d513e70c-1423-41c6-960f-2ddd2d2a7684", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534394, "uuid": "8ee5f492-bfc2-4032-a1fb-589d978ed4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534394, "uuid": "3a51df8f-0f3f-4683-a59f-0c2d1cb8ce7e", "value": "fda0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32611ed-131b-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659524601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524601, "uuid": "837ab099-ee2e-43ed-87da-db4027ea03c6", "comment": "Malware payload (DBatLoader)", "value": "30638d1c32abe8b252266f72e3e4fce7", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524601, "uuid": "0498d2df-af61-4c7e-a22f-b71f17c3bf42", "comment": "Malware payload (DBatLoader)", "value": "cde000f35181379ff1cf4929cbd6b48318c5510236d3dc79b0f0bd66955f7ebd", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524601, "uuid": "fffb0079-71f7-4ea5-a598-493430ed1c33", "comment": "Malware payload (DBatLoader)", "value": "7959f2ad5c5a5b778622c368a3826fe6b8023169", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524601, "uuid": "3b1ef458-f85e-4f67-bf9e-300266fbc3db", "comment": "Malware payload (DBatLoader)", "value": "d3eb820dba9ace676a22842696348ee5fd4237d57a32886f53a124f3a35853b81c6fca4adcd32f99a0a0ecea97406702", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524601, "uuid": "da70c9fa-3f6e-40bb-a054-3367a789e960", "value": "T156759D36B2904433D07216789D5B53A8982BBE112E78798B7BEC3D8C5F3B7913925393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524601, "uuid": "8a3d268d-65ff-4465-8c40-fb31547a27c0", "value": "24576:oNZFLUG3u3e+CuySLJj7tGZJqz5d52Ep8rl:ojDVk70UForl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659524601, "uuid": "874eec55-a0d5-4214-8771-1ff02fcb81e7", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659524601, "uuid": "f44622fd-74ff-49a2-ac4c-bd005793c791", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524601, "uuid": "31168c95-4cdf-4267-9a0e-6a718ab90f1f", "value": "PoonginPurchase-Order737883874.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8c41c4-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537901, "uuid": "1dd048c8-8df1-4c3c-8610-1e7468c3d9ac", "comment": "Malware payload (SnakeKeylogger)", "value": "6f7c4f5237c484fb99a91532c37bc826", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537901, "uuid": "cdde1e74-cad0-46a4-b723-caa5e61c3f6c", "comment": "Malware payload (SnakeKeylogger)", "value": "ce7d9fa17dbb50d34af98a63640aced2cb441cac1dd4808a32d4006cfae8d92a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537901, "uuid": "8c498293-9d54-45dc-ae8c-ef0c4eb1db90", "comment": "Malware payload (SnakeKeylogger)", "value": "8506310b0e2ca91e557620eb617b008b4d8d94d5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537901, "uuid": "8413f955-7f67-440f-b744-88d0324e937d", "comment": "Malware payload (SnakeKeylogger)", "value": "bd61f9410410e59563c34ecd2bc624ec777d18eac79b096acf23f19b656b4744ed88d714ccc9d9bdba3d806e3e9708c3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537901, "uuid": "12a4ccd2-4217-4273-9e6f-7ebae990f09e", "value": "T135E412C239BB4B13E9795BF5B120C0860BF2626F6123E2886DCD7DF7657979302A0953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537901, "uuid": "427c1d79-dfb8-4c89-b9fe-a912c8adbde8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537901, "uuid": "fef11b1e-690a-49e0-b0e4-52fe1473c5a8", "value": "12288:Ug6SKlpxEUpktWi0+8OpBppAgGdXPJW1/2KhzY7JMY+:2Llpx3m8OpBDNGFHKhEJX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537901, "uuid": "bfe62668-2f5b-4fe8-b8ea-66df80b310f4", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537901, "uuid": "e059e44f-79ef-4b55-8f70-8559f03da944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537901, "uuid": "a15230a8-2278-4202-a562-40ff75149b10", "value": "DHL TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762ba8ba-137a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659565220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565220, "uuid": "593117de-29c8-48b3-b148-f0db21751344", "comment": "Malware payload (Stop)", "value": "11dae3da4710eef654054a014ecafe13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565220, "uuid": "68d8eab0-90ee-4377-bc35-2b5cc03f108a", "comment": "Malware payload (Stop)", "value": "ce9398957a4f2d577967e6c2af8319c07d0c628fbe9d7530f1a6d53fe1e09ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565220, "uuid": "8dd5fe3d-b15d-4893-979d-59439f0ee281", "comment": "Malware payload (Stop)", "value": "ff1198295c3d2c40461407a38924bb7dee10ad4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659565220, "uuid": "0da33b29-a557-4161-a4cd-7c255201efe8", "comment": "Malware payload (Stop)", "value": "63e4274ef45306945f395abf479f544b00cb9dda77409fa1e5a31324518c79f445ea2b0e99b9bf75dea3d9c9af7a456a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565220, "uuid": "f1bc463b-3c36-435c-af1d-6895d4e2243a", "value": "T181F412707640C072D2FB21305475CE659BFFB86626B85A8327981B2A7F623D02E6C75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565220, "uuid": "d6e858db-8bc5-47f6-bb99-cca49fd4fa14", "value": "be08305409075fcdd4a5fb8689b69de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565220, "uuid": "a08998af-a1f8-4395-88eb-4fc7850c1595", "value": "12288:RhU4SlMDTpzuidzfgUdzW6+vcwk/iCgldRVr1n0/0JyvgWTbv48jsR3O6VB:RGlMHpz7dlW6+UwkTsr10/Ym5D486pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659565220, "uuid": "c4de71fa-6f16-4046-886b-53a3d14dd513", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659565220, "uuid": "2b0d82c6-d65e-4e97-9d75-995735391dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659565220, "uuid": "78078d40-934b-425f-8a9e-a74c77375c50", "value": "11dae3da4710eef654054a014ecafe13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b29625-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537913, "uuid": "e734525b-cf7e-4453-ae1e-5cd5d59877da", "comment": "Malware payload (SnakeKeylogger)", "value": "faf9665745cf6b4ae2a166561a6076fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537913, "uuid": "8c601033-2e73-48e0-ad43-5d7cfd2cf2a2", "comment": "Malware payload (SnakeKeylogger)", "value": "cebcb5a2ae704c34b4766e912583e194f6b98165401225c9d0944af24edcc291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537913, "uuid": "5fb64d77-82df-48fa-8de5-0ec121dac82b", "comment": "Malware payload (SnakeKeylogger)", "value": "b7ac8fcd870b629a7e2676f77f7f4e7e9ac01f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537913, "uuid": "899a75dc-37b3-46a7-b180-f3fcef7698d1", "comment": "Malware payload (SnakeKeylogger)", "value": "09e3e6e9cd969e26281654be6f951965baffb7e5a1c45b894ac99824344dcedb8a636a4124fbd21145b98a412eb4eb65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537913, "uuid": "77421fd8-9b32-45fe-aadd-0509b24b91a3", "value": "T115A4BFE1F11046EDED7E173268271D920A531CBEE7B9E25C60F971232BF7263402A95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537913, "uuid": "d769267e-b8f9-498e-8d52-5084a9943d25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537913, "uuid": "435a7012-c363-4b1e-847c-b8320c2df186", "value": "6144:WY9lSSxmJp4s8LxGpkm1ShS173ZJf4Dcc30GR9XWVqB0:WqSSS+s4xGpkMeSxZJUjEGjoW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537913, "uuid": "634dc17a-b873-444b-aa01-2b25ec6161bd", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537913, "uuid": "5409d1a9-6065-49b5-a9b2-977425a7c0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537913, "uuid": "a98d7213-3e66-4c69-8e40-7b93113fddb9", "value": "SLP87654345678000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a92ab45-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659539431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539431, "uuid": "80a2cff4-15a9-42ad-b874-d50849a42b3c", "comment": "Malware payload", "value": "ab1f83bfa79e1f14b47829322e432052", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539431, "uuid": "a59f87da-181a-44af-8f4b-2cb4895cef46", "comment": "Malware payload", "value": "cfc7850f9752447ee7eecfe9f90c0fdc2709e9145a9061561a0538c8c013df28", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539431, "uuid": "870c615c-f125-481c-8b93-9647b77fb42d", "comment": "Malware payload", "value": "dcd93ab077f831af47cd041bab9cda6d99c97186", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539431, "uuid": "8acc75e9-781f-4d2e-abfd-c2a067ebb972", "comment": "Malware payload", "value": "ed11e6c7fd2139034f43427033ca9a181719758fb74c9f21f71fe8a658b8ad7a49c8cb15a7898c7ea468e699e61c212c", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539431, "uuid": "782ffb8b-9c80-42c8-907d-aa520752d568", "value": "T1EF51AA0527DE4716D3B24A366C76D7004A327521ED93F31F8190B5CC68D2A54F9B9F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539431, "uuid": "65593745-58cb-42ae-b3e5-943c38737879", "value": "24:8YypnpQk7pyAN/uPkA+/4xZyQg3ILBUBBi+/E4I0xGkHW2sTeEIdkI04YnQu:8lJN/ueQLeBkAIzp24eOIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539431, "uuid": "fd8407f8-7afc-443d-9e59-3ca1022f9981", "value": 2965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539431, "uuid": "c45f58a2-d78c-4b66-b9fd-42cef35b0ffa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539431, "uuid": "ae5ae0ef-81ae-4800-ad1d-73d0711cdf3c", "value": "lebenslauf_2022068 .pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af578f2-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1659512669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512669, "uuid": "ed0bd6d4-7fe4-4960-85be-b447da1e9fec", "comment": "Malware payload (BluStealer)", "value": "bd2911bbd384af389decdba086b7c19b", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512669, "uuid": "e71bcca8-1df5-4c45-8f50-09f75bcb1ec7", "comment": "Malware payload (BluStealer)", "value": "cfd47d618a2b834721c1d92e04fde437f102317abfadd716b308ff6e85251733", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512669, "uuid": "a98af6f8-40d2-447c-8a1f-a375603e9b89", "comment": "Malware payload (BluStealer)", "value": "4e5d98b5b6797348b17d14b557519c9f738b01b7", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512669, "uuid": "05e74614-f5a4-4444-8fc6-b92793ed9445", "comment": "Malware payload (BluStealer)", "value": "d4aed8967c5b502dd742dbc10937183aff487b73189386d4d2de540be14659dbc2795cb88d1934c301f58006af02866d", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512669, "uuid": "7e0662a6-5aa7-44c7-b559-5ec92a8cbef8", "value": "T1B103F2C354BE260A0FD98EDC0F3815DAF46D1194A1AC612A339CD9637B2325E78617DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512669, "uuid": "5777e6fc-1a1b-40c9-8cbf-06b118303080", "value": "768:KMPtosjpqtfKDt9DuGEuPh/FU+Biv0L4a/pz144QCuq54Lpy7/UtePGmh:dktiDHuGj6vta/pzm4JuNg7TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512669, "uuid": "331f8915-7628-4a77-b75f-1e30f18cdc4d", "value": 38625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512669, "uuid": "e8ccbdf8-7b15-419a-a842-c7f840b77932", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512669, "uuid": "40325c50-b2ed-4cff-8178-3ba1122406b3", "value": "Quotation - Drawing Data Base .xlsx.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3fb6c7-1307-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659516025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516025, "uuid": "e2c7ff73-d8ea-4484-8411-1e2b4fb93c92", "comment": "Malware payload", "value": "30f3dcd747b1bcd2d37f1cf87f43fbae", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516025, "uuid": "8e7fc1ac-c7dd-4916-954f-191d54d575c4", "comment": "Malware payload", "value": "d177f6ff7b8fc0ddcb4f16a5c501c2479b47733e350761d94d35a107a99e94cf", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516025, "uuid": "29b16b01-7049-4614-ad44-ee36176937ad", "comment": "Malware payload", "value": "e89629231df0e5f3205e64fbdaa2558847a8b5ed", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659516025, "uuid": "6a97f2b5-b76b-4be5-9cc6-8e5ec0e5ea88", "comment": "Malware payload", "value": "7b1c728bc82eb0a22b78c9c548ef04c3544b9bee339b4a8a9ad2b6dde22b448a0726ce4f7a4470b0c8c0f0c7beae92a8", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659516025, "uuid": "1bf44d73-30cc-4f2f-9ef6-3e9cbf52f453", "value": "T11AD232A2B28AC949E945073A5DE3CAA72727FC859FA347477258F30E1E749C08903B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659516025, "uuid": "3b09e1c5-4194-4c12-a530-b8a51faaddf3", "value": "768:KcKoSsxz1PDZL2Qiw+4868O8K/5Le1k3hOdsylKlgxopeiBNhZFGzE+cL2kdAJfA:KcKoSsxz1PDZL2Qiw+4868O8K/5Le1k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659516025, "uuid": "49c3689f-ee08-4281-9f8a-0c44dbd960a1", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659516025, "uuid": "488d45f7-3591-462e-a2b7-2194e11ad1ba", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659516025, "uuid": "b659fd11-341b-4532-9e32-dfe1393e5434", "value": "macro.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5068598a-1324-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659528220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528220, "uuid": "eaafda0b-d241-4df7-9ed3-0842f4703f51", "comment": "Malware payload (Mirai)", "value": "25532ff94959ed43b4a81cd8e671d4ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528220, "uuid": "4f2680f0-2c23-410b-ac57-18c59733169a", "comment": "Malware payload (Mirai)", "value": "d1a2784fe324bb26da9aa73d4ed21483c6e4868accc82315fc019064abe6f6d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528220, "uuid": "e16f69eb-2792-40c5-8a92-3a52790eb769", "comment": "Malware payload (Mirai)", "value": "c1c4eefb5500956cb902a4ad28598fbb2794e3f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659528220, "uuid": "38c80f42-9a01-4c49-b93b-6dcf8d3cb354", "comment": "Malware payload (Mirai)", "value": "3173cd6b0e2a78c5535f2a460cf7e1c86d024f352763b48fbb338604b9a1c28f45076e03d4c819cbd571fa7c9f4ba49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528220, "uuid": "52198642-aea4-4fef-b952-8e083777a837", "value": "T1D6933A517C819A22C6D8227BFA6E018C332663E8D2EE721BDD219F1137CA56F0DB7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528220, "uuid": "0ee50250-df36-47a6-a54b-a647ed69435f", "value": "1536:MHt84chseVyZmthwgyaAy9RxJNDW1VlWLmQ3Q9gz3eOAbENWesRMvE:MHedseVyZMImeVlW53Q9UbQe/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659528220, "uuid": "a3aebc7d-c42b-4119-b42d-a3223fdbadb8", "value": 93232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659528220, "uuid": "3fef48da-7a7f-42f5-84f8-840fe64bef35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659528220, "uuid": "f0a43cc6-a742-4ceb-ba12-62fe069f8d13", "value": "25532ff94959ed43b4a81cd8e671d4ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058ac62a-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542697, "uuid": "cd543ee9-5e97-40b4-b417-768267a8004b", "comment": "Malware payload (Mirai)", "value": "e7873ae8f2daf39d511750776c0c3604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542697, "uuid": "bead0598-2d88-43e4-8abf-c6b0d82f7dac", "comment": "Malware payload (Mirai)", "value": "d26d45d4acb59c32c0df54f75c9a5e5d10c553e036b220a6114489c6b8f02fc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542697, "uuid": "5bbe930b-92d0-4721-b0f6-6a1185c05422", "comment": "Malware payload (Mirai)", "value": "bc522b0f5981271ae0d26f1299c12aba42f043bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542697, "uuid": "fcd00a9b-7a9d-45f3-bb49-93a03a7ded7f", "comment": "Malware payload (Mirai)", "value": "2401ab4b1aecbfdd2272450fbbfdde3118fab176b5cc6592dfd55bfd7e8c46004be8c5b65510226b8f092024ac7d1a2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542697, "uuid": "e5cc3a5e-bbae-482b-8da0-3531345784e1", "value": "T152B2D03C1B111B98DA1EC0BE839C0B513DB81B3591829D8B6217EDD7AF5A4747453AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542697, "uuid": "43064a4f-a3a4-4d2c-bf6f-22d066293e20", "value": "384:6eD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuilmd1JgGlzDpH7uNj1JA49:6eD8ZSWvZHZbs1row697qohQvg9li1JG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542697, "uuid": "3610ec56-e21c-4e22-97ff-bf9f78076fa9", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542697, "uuid": "16d5b498-0bd7-4fff-b2bb-e750bbaa7baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542697, "uuid": "ea076905-046e-4c29-8f9b-b6a6fb19b569", "value": "e7873ae8f2daf39d511750776c0c3604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b33c129-1369-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659557927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557927, "uuid": "0650a6c6-e506-4e1e-91d7-47530b26fc16", "comment": "Malware payload (Formbook)", "value": "c31f50ad46656183fd2c80422a7fc62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557927, "uuid": "870b3574-26d1-4214-9b94-5576809f9b2f", "comment": "Malware payload (Formbook)", "value": "d2db856862b3d18c0037da9ef48d214f038e95973c1eca4572331c83b84b704b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557927, "uuid": "da7429d0-0860-4cfb-970d-47062ee13599", "comment": "Malware payload (Formbook)", "value": "54b6123cc62f98aeb7287bb4fb9b7dbed2ed5414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557927, "uuid": "e42895aa-b6a4-4b6b-a7bf-d3c691f8a35e", "comment": "Malware payload (Formbook)", "value": "76b68af82235ebe47287dccaadeded81d07876ec88ae80d39c37d98c60114ee2ba34ebd60a5dfb5dee21055d5cf188ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557927, "uuid": "efab5d23-155d-4f47-9b34-953978540cdf", "value": "T1FDA41203B0BC1AAFE513B57C603A216855559E43F2526E05BFFCC89F414E22E1BACAF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557927, "uuid": "13a4e7fc-5931-4540-bde2-9fc2cd9200de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557927, "uuid": "67b3a239-35df-4a1d-8637-b7fa97c1271e", "value": "6144:wP8mx0GGuGuEEQY06zR9Mi8CHSgqWEZbFsfCCexrAyx1YczL3j919zCV+ScB:rmx03Jg99SCHgbFGCC0Ayx1jzLwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557927, "uuid": "6ba49893-06b2-4311-be4d-a6c488525579", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557927, "uuid": "544b88d0-ab63-493e-92b7-573d14d2321b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557927, "uuid": "de2fbb8d-0249-4e07-b734-283cc1e40189", "value": "Zahlung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bce6e8-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659534162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534162, "uuid": "e84b0ce0-6033-460a-b391-a58921fa007b", "comment": "Malware payload (Formbook)", "value": "5fe3fdf651b03ae9999f3235dc307d0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534162, "uuid": "538f4f9d-1e29-4d9d-9b71-ed9942c391f4", "comment": "Malware payload (Formbook)", "value": "d34ccab2c9cb8c8bbc5bfa36935a33ff3de13ebfddb55e54a103756fe911c964", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534162, "uuid": "79e6ce2e-3060-4f12-b156-2ed33b5d0e7c", "comment": "Malware payload (Formbook)", "value": "836c5ddc0f295393dcc18ce3da46b1fb41a1ddc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534162, "uuid": "27403f64-663e-4347-bd7e-f70b830504ba", "comment": "Malware payload (Formbook)", "value": "ae2d72826d6834b364ff2c6818f3e2da2e1133285c94147496b57397bfeadf9bb27f4d35917df20ff58e515cedc23f50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534162, "uuid": "dc613fc5-ef31-4a26-ad25-49c2d9db3a71", "value": "T11B64CF4A6BB8CCADE8513C76AC6203E14675AC633F56C3361791FF368039D8B43692D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534162, "uuid": "53028a54-606d-4ea5-bdec-8014b0943737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534162, "uuid": "fa8ff21f-2502-4f87-867c-6fbac070f510", "value": "6144:JOzqei+7tCirE7PREDU2VqgM9ScHzKgukNqm3AY1jGVOVVVVEVVVVWVVVOVVViVp:JOBTrEDREbVWHmkNqa17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534162, "uuid": "f481df8d-3fee-4b86-acca-e9775d3cfc34", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534162, "uuid": "a710a07d-bdfb-4282-87b8-87a33cc879cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534162, "uuid": "b28ace3d-da8e-42e5-8fb3-1ebbcd075d55", "value": "5fe3fdf651b03ae9999f3235dc307d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610b7c21-1302-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1659513645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513645, "uuid": "54ecec91-1b11-4896-b2f3-363f98c30da2", "comment": "Malware payload (NanoCore)", "value": "15e305f58121f6109d29ff511c55f248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513645, "uuid": "74bf3576-4bbe-492e-8a9f-96f513cea063", "comment": "Malware payload (NanoCore)", "value": "d404c5c21e05bc1d59b88190b7d156d33788a7c6041b03dd7b2ed69019c880d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513645, "uuid": "f0a9ce31-8355-4e0c-8ac4-26a20e3485e4", "comment": "Malware payload (NanoCore)", "value": "212dfd86781435360f8e8d397609dac6cf264a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513645, "uuid": "d54bc4f9-093a-4817-be83-3617bbf81e42", "comment": "Malware payload (NanoCore)", "value": "8aa6cc3c24e44e2552dab39c918123c04887ad69fe5f6d45f2069a34c3846ee7472bf2cb6eafb7387364de78ec668bf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513645, "uuid": "e23be4b6-a207-41a1-9925-a3415a726207", "value": "T19215023B73DBCB03C1244D79D4C70D910369D6AF1372E346B8AD3ABA6A9735689C1389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513645, "uuid": "8aef693f-5e94-4628-ac70-746449a38d13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513645, "uuid": "4a9098d7-7331-42cd-8a1d-fc47268419ce", "value": "12288:U8xg6SKlpxnL69yn7cOERg1janrRjkj0Q8yhJhPQHPtREr5SehT:U8/LlpxnQyAOWhk4Q8iEVHST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513645, "uuid": "9c2a99ff-05fc-4e06-b12f-4178c2b229d3", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513645, "uuid": "7ef91976-3249-4a20-857f-8641fa57f402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513645, "uuid": "f1d34eb1-b099-4234-b173-392070790e83", "value": "15e305f58121f6109d29ff511c55f248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24057fc-132f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659533082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533082, "uuid": "6fb9c6fa-9e3c-4119-95a6-b70c09d76b14", "comment": "Malware payload", "value": "b50a5b3b8b97d468c1529e6125efda32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533082, "uuid": "43d55a6f-dedb-4b6d-a9ca-089491ca28f8", "comment": "Malware payload", "value": "d44655b5b3f0368c8f3798ccfb8616132f3a1bb4db840182365a1e25b770cfb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533082, "uuid": "a4a581cb-db5e-43f1-9e9b-abcaa01798cb", "comment": "Malware payload", "value": "e41c415fb0f9fdd7f86bd429ba490b0f15244f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533082, "uuid": "dcdd0dcc-1c7f-4cc7-8136-a68c4597c849", "comment": "Malware payload", "value": "ed852feb5719346f2313c6fdb025236a0e425dd646974186e72edd2a759dcb03837be16aa13a923955b28413d187cc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533082, "uuid": "ef7e2e24-da70-478d-b664-2aec90390d1f", "value": "T18F543956A3AC099EE9678935CDA39717FBF27C051250D33B1290DB365F33B2AA538311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533082, "uuid": "d0c3d956-cb76-453a-89b0-31cf94387799", "value": "6144:+Cf08fLIWAYpBJ7TBV16yH8UDfQhTi07imE6G4vvQl/cK8c5dMZ/APA4Riq:+wTAYpBJ7PgyciQh+02mELRvbMZ/AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659533082, "uuid": "0e95c539-e848-4f24-8ad8-dea67f9c5b92", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659533082, "uuid": "0d5bdce9-c621-4216-87c1-28e34fcb7f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533082, "uuid": "1d9364b8-feed-4261-a874-8a672f7c130a", "value": "f280000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5b93f0-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659539114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539114, "uuid": "dbbbc5c0-0adf-4e37-b91d-44dd61ada0a6", "comment": "Malware payload", "value": "34485bd94b53a30912539d352f1306f5", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539114, "uuid": "d7a45f49-6900-4eed-b49d-dc0e4990d617", "comment": "Malware payload", "value": "d684e49b2d48869a44cf266fc002592fb755806fe67991af270d642d21f742e4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539114, "uuid": "04ed9b26-d328-40d5-8411-1c31b8770718", "comment": "Malware payload", "value": "878a162da1f3e26e953e43f784935ab82745f52c", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539114, "uuid": "63f752c8-1596-49b5-8523-9e05b464d48d", "comment": "Malware payload", "value": "7e4acca1d9c8e13d7ffb2bdf320125bfcfc50e3f093442442fc6b0fc99bbb428b935a8bfd0a911b9b9d38557ddf672f7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539114, "uuid": "eef0378c-5832-46e0-982b-10890e8b128c", "value": "T12B341223BBE0227EE6BBF67059A0B7505D5C8EA273129A69C07337412076DF947312DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539114, "uuid": "387ecc49-22a5-4cd5-b45f-82b8b507c9a6", "value": "6144:9BD5JA1N+3Ha/hJkXwqSZiyHrPif5uHInySFocsQBG:P5SqK/hJNeyLqA1SF47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539114, "uuid": "66ca0837-2b81-4974-a6cf-b9e54a312931", "value": 246168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539114, "uuid": "bd0f1f4e-1f23-4627-bb68-21bf0e17604b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539114, "uuid": "95fc6c02-1237-4b71-ba8a-8b784bf118a3", "value": "FA0000017284..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fec03a-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511808, "uuid": "12687e5f-9688-4f23-940c-d9f1fe3f7b1d", "comment": "Malware payload", "value": "144a33a5885b8609c03fc1bb09a7022f", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511808, "uuid": "8ed16148-4712-4558-8767-a335e54d8bdc", "comment": "Malware payload", "value": "d7678ae584baf630f90b58589cf75bf2be143f4a95d23773859c228d4852551d", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511808, "uuid": "663a30a2-5a0d-42ec-8f16-abf6ea2a861b", "comment": "Malware payload", "value": "631afbe5a96c1b9c77d3eb5946290ab1acfeb03b", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511808, "uuid": "98f44b4d-1d59-4e61-a7f0-6266bbbdcca4", "comment": "Malware payload", "value": "becc13fb985de0ddaa43f0109ed35f37e89fe0d7c96d928dec33e176e6e17ddeafbe8178838a584621d345b53ec89b21", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511808, "uuid": "cf0e3be8-fe0f-4f4f-9a43-cd3aa8497e54", "value": "T1D65103533091B8A9415287BF3E5917FB807FC224A54AA441F78C5F98F8DDE633A8D2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511808, "uuid": "515dd6a1-511f-48d7-b325-29a31397ad4c", "value": "48:L+MTLimb70Ed3/HeZnW1I5QfBZL0huQphF15QsETfklxZgYUmvk:CGtEEd3/HOnW1I5QfBZL0hpBufklbgYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511808, "uuid": "c97d4598-1173-4690-b6f4-efe298f7d388", "value": 2994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511808, "uuid": "9408bb1f-19c7-4a7b-b78a-d5f81aef3788", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511808, "uuid": "acdf5627-1577-433e-b3f8-893cca79e426", "value": "meta.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3f024c-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511896, "uuid": "ee9420b0-8906-4f4f-bae1-f16aa904de34", "comment": "Malware payload", "value": "7fb6c8ad87732bfef2f07b00c223c88c", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511896, "uuid": "351ebea5-b372-4ac1-b37d-46840b45da37", "comment": "Malware payload", "value": "d88e0cf3f7bd005e1ca7daaca24862f85ec5dec1f07edf339776a2e53eff4306", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511896, "uuid": "c8e37e35-b9a6-4c2f-acd6-d6e01256d290", "comment": "Malware payload", "value": "be842efe8d51e3714ed77cd3a4768fb5e31a17ca", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511896, "uuid": "396943ad-3820-4515-9e6d-fe0ce25d302f", "comment": "Malware payload", "value": "cf12a688f3375e2bcf3f18b11c64b406c9c84f46998e3b4b4c042bc08a472454dab1748d11ba9ca32cfe84dba2a3afeb", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511896, "uuid": "15431c8c-d948-4165-a107-a9f1b02b7b54", "value": "T1F6E36C47B3A830F9D1778279C8521606F77678360B219B9F17A407762F272E09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511896, "uuid": "cdaefae3-f9ad-4f40-ac9b-1a0892ed0c8d", "value": "e3070524bbbc3ffd8ae9e5fe55c442cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511896, "uuid": "29e6dc77-21c0-4b94-9692-e268dd1b8144", "value": "3072:KmYBA2+2BqApimJmb8G6J2sNzVeacQrYY:QB7z0AsImgGat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511896, "uuid": "7b0a8811-9935-4f5e-9949-b4a5bf955ac4", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511896, "uuid": "26992370-d636-48ff-a689-145dc080025c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511896, "uuid": "2f92a9b0-1ff5-435d-99c5-1ecfb0431c59", "value": "KRBreq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0714dae-133c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659538689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538689, "uuid": "88f39042-364c-436a-97b1-44c12d8252a5", "comment": "Malware payload (RemcosRAT)", "value": "144a6de371194d4c15cd9dfd2c8f7015", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538689, "uuid": "5f3435c6-e60f-4305-9fe0-d952dd8c6f93", "comment": "Malware payload (RemcosRAT)", "value": "d8f978696711a048068cfcae0b8efa9adb26eba4d449819d7893d6a7cedca64c", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538689, "uuid": "06fffa8a-dafc-4f52-a75a-a348bcd50ae1", "comment": "Malware payload (RemcosRAT)", "value": "e4b39e8f0e92618655990c8ddcad20e8754f775a", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659538689, "uuid": "70e60eae-5dde-4b8c-81c1-fb56b8d1e334", "comment": "Malware payload (RemcosRAT)", "value": "88f3e983ee72c89645e83308552fa5628127b1dce8cb2499a0b5141293a3a6404950ff00fa551e8fb7989184fabdce07", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538689, "uuid": "c9251248-46d4-4a6d-9c48-2ea4b1187c07", "value": "T1E5E25EA2B395DC06D99907764CE7C7D62726FC91AF63834B3289F71E1F72A808D03616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538689, "uuid": "5c1e1f87-3bb4-4ddf-a442-942e506fea14", "value": "768:Hgk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJxWv/zaK/4yOz6u0:Ak3hOdsylKlgxopeiBNhZFGzE+cL2kdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659538689, "uuid": "37b595d2-984b-4be7-a02f-06780881bf8d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659538689, "uuid": "0a1805be-dfdf-4e53-bae2-a712fe24bc53", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659538689, "uuid": "276ce769-de94-4a4c-be98-f1b3676ae861", "value": "remittance advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45824a40-1386-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659570293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570293, "uuid": "5c9577aa-05a9-4862-8eed-0c920327f886", "comment": "Malware payload", "value": "be4df7b7e45f18887a0b511bd195822f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570293, "uuid": "fd853b3b-65d6-42cb-b0a1-c4bfffb13427", "comment": "Malware payload", "value": "da2fe6fee81f59168483db67d1301b1e2a11a2b79ac032e809486549bf42f1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570293, "uuid": "b30154f4-207e-4c7f-9913-649b598e7a74", "comment": "Malware payload", "value": "15ea471045401431950b369299f9cbe54e661b47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659570293, "uuid": "8f19ed6c-d604-4b14-b817-4caa23b4cb24", "comment": "Malware payload", "value": "987121c3a6c0911c6a99b3e8647ce4c818261918deee83d22cc7eadea1d3264fba5fa033f07b4ff4f5ce8b33ab3531bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570293, "uuid": "199a33ae-1263-492c-ab7c-3874b6aede28", "value": "T10B733A1A78D3C033E8450874C5D186C15FFF9D2376D6946FEFA9068E5AA02D806BABB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570293, "uuid": "f9312fa4-be61-4dea-9634-5a171c4a13bc", "value": "62309a495c8c304259f74d2c7a6b9f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570293, "uuid": "581289d7-f2a8-4f8a-903c-f5fd90291896", "value": "768:eAwNCKTBTxbgEq2RJH6Qe3qx5AUjp/bug/9ngYm7zxG7sRq7J/+qL/b+khmbJrwk:eHEmTbNBJHLcU1/bat3Rq/+c/hgK8t+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659570293, "uuid": "338d321c-adf1-4d01-bc58-efd53cd11f45", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659570293, "uuid": "202edbbc-0eda-467c-814b-ded542c4a877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659570293, "uuid": "5c4720fe-900b-43e1-ae71-9fb5e63d20a0", "value": "be4df7b7e45f18887a0b511bd195822f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26165d8-134c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659545672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659545672, "uuid": "7ba9a476-e104-4262-ac4e-eb93f8e390c9", "comment": "Malware payload", "value": "a4d6f9eaf41c784650c77644ee267b95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659545672, "uuid": "5e5a9e90-bcd0-4a37-ba90-610a7c9a17cc", "comment": "Malware payload", "value": "da82d2c2a40df61688070a0ce02d46ce4dba99e4ac3e419bba27d950ef00233f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659545672, "uuid": "49db9c1b-c517-4aff-97dc-8d66ed984180", "comment": "Malware payload", "value": "ae0d9a4aae2f806af8ad452b493df9b3350ee06e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659545672, "uuid": "1afc8896-16f2-4adf-8d07-31eadda0b5fc", "comment": "Malware payload", "value": "ebe5902415aa938fd18038e9fc1121f39eb47cfc425b5673746f9d6f11f6b4e24d961d7e31c016d26ee02662e72af2f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659545672, "uuid": "930a4c25-13b0-4105-bdb4-36b4e39722db", "value": "T19405E7448ACB9749CB3BF3F7579A304369D5A66343180045BE9D340EEFE691CA4E26B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659545672, "uuid": "0328ff3b-03d8-44b3-a774-8862d3645ab8", "value": "12288:9QLW5Whiwr6rpfwO1C5u4IeRkN1IAmUOY7vpHS2iZbyfW/DNM:q6Whiw+rSOb4pRC1IAmUzfW/Da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659545672, "uuid": "f22071c7-7043-4c8d-adbd-e9fcf9e1623b", "value": 836185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659545672, "uuid": "2f92d974-b13a-4e53-a0cf-4302ee7539ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659545672, "uuid": "407f3304-addc-45fa-bb4b-5912faee98b2", "value": "gxrbxg.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7836cb0-1348-11ed-93bb-42010a9c0043", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1659543882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543882, "uuid": "ee429fca-6cf1-4003-b36e-3244271c35cc", "comment": "Malware payload (RaccoonStealer)", "value": "21a7f08eac2c62f28e3798315e107423", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543882, "uuid": "c8e2a6d9-0a54-4d1e-a8a1-b8abf8830a89", "comment": "Malware payload (RaccoonStealer)", "value": "daf990cdf0120a2c6ffad7b627637de2d60680588a93bfd6f5e5ca1e730d40cc", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543882, "uuid": "4a8ca843-6c07-4b6a-bc1a-f70b77ff2dc9", "comment": "Malware payload (RaccoonStealer)", "value": "d3b7d94b424972dfa4b6858237c5ee30df63e56b", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543882, "uuid": "183b8c2a-625f-4652-8a38-fa46975dfa54", "comment": "Malware payload (RaccoonStealer)", "value": "71151825cac1331d26472cd6c27142a5c81fe8fa672e9a8d1c06ed7f89541a2ba996dd5f35c8a51326fa4c9ed18a8d6c", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543882, "uuid": "adaaf447-0e68-4284-8b7c-0365aeed4305", "value": "T11E94237D1EAD9C86C6E3B137D7D7430F97AE50966A6010E4C3A68109C6F58CA2C84FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543882, "uuid": "5f76a38e-9157-4cf6-ad9b-cfef60a96c58", "value": "6144:h7bVwOKJGOaba7EOdnTfNcJKfRmiYeyZ1/6lS6uewwGrbQoaMRO75bjlEn0MTtlY:h/JK4OauZryJbB/6lQmEODQ0Klqxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659543882, "uuid": "1dcb203e-df25-4fbd-aef5-10ccb1851c32", "value": 424939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659543882, "uuid": "efd3b6ae-8972-485e-97d8-e5349ca00da6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543882, "uuid": "83f29e61-60bc-4097-8879-99e073d86d3d", "value": "8685d928d1cac18cf8f70aaa85cdb9bcf8cbe7b033cb9d0fd15a6c537a855dc8053e16dd69ae61692d77ed7da891.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88ce4a3-12d0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659492344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659492344, "uuid": "65ecfc37-ee0d-44e8-b7d5-2b73600ccac0", "comment": "Malware payload (RedLineStealer)", "value": "99342a4b5ce806ef4ab2a6d89ba8e99e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659492344, "uuid": "65ced5ae-35ec-4fb0-9dfd-7b8c67231c5c", "comment": "Malware payload (RedLineStealer)", "value": "dbf20dc429b1ae7162eae6fe859333e380c57f1681dac1b31f401b209e0e93fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659492344, "uuid": "189591aa-9b68-4480-8aab-fe3cf790cca0", "comment": "Malware payload (RedLineStealer)", "value": "99ae91c56960c1149ecdc56b92f0c236c369c1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659492344, "uuid": "d90ec762-8a03-447c-ad37-cb33e4acd847", "comment": "Malware payload (RedLineStealer)", "value": "088269b6dfbc3c53c7da9709231706a6c5ea96c40c3086369dc21d110a8c351bc8942b41dba1c163df4d8e96b7cbd801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659492344, "uuid": "9411194e-1e1f-4947-8e6c-258159323413", "value": "T1FDA4C040B6A0D03DE0B312F4797A93A8B52E7EA1573414CF12D52AEE16386E1FDB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659492344, "uuid": "c9ec61d3-bacf-4b94-a51a-68b833a641f8", "value": "7b13e4090c99826947262651b64e9d68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659492344, "uuid": "71b787a5-da64-4b9a-baab-6399c6512c37", "value": "6144:guTwfGqT/KA6fDNMpa7q5wDk37w6GI/M3Wj5ROastJ9YbKdkKphYghH:xwx/KTfDNMph5wDUxG7GFIyyLph/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659492344, "uuid": "3cdf69cd-f941-4ce3-afde-f8c5709d7f9e", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659492344, "uuid": "2b87cd32-0386-4b0d-82e1-8a861488f5e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659492344, "uuid": "7985b00a-9d21-4463-b225-b401697764f2", "value": "dbf20dc429b1ae7162eae6fe859333e380c57f1681dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b974eaaf-1347-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659543429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543429, "uuid": "c9d09892-9fdf-4ccf-882b-6419c0e0cf6e", "comment": "Malware payload (RemcosRAT)", "value": "52d12cdba1e96ce2bc18685e16c6904e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543429, "uuid": "37f9d3d2-6762-4d9b-a3e6-c3cc14baee56", "comment": "Malware payload (RemcosRAT)", "value": "dca2d6e3f3b63d15829cad917515c62528de68fd2d0c2592a4106ac7b26d097f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543429, "uuid": "580a4eb3-48f3-4f46-ad12-bb6376ef6a13", "comment": "Malware payload (RemcosRAT)", "value": "70ab79ca3303cb52ee21e57d38d67504b97e704f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659543429, "uuid": "9cdf157d-73ac-442c-a9be-fafada8572e0", "comment": "Malware payload (RemcosRAT)", "value": "0831875fb3b9927fe6f916510b00fa4dc14fb776a8214f77c4e04e34326823dbfa691775c96b09a1efae7562bc3d58c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543429, "uuid": "1dae7756-aa4e-4553-ae61-f52da74c9e4c", "value": "T1CE156BF5553ADE9AFD84AAFCD5C090944BA38D30DA9000497331770EAE73FE6789E918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543429, "uuid": "d0affa36-292b-4426-acae-f91527b0eacf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543429, "uuid": "2f20722e-88e6-4562-8c17-b0fd28f63960", "value": "12288:Bepy350vYBz0OOS+GcLPIXxi5yRHxpCytTjJysmPQxcSXhenbyL0FtntGGzGtGGR:Bepy350wBzLcaw5yRxpCMjJ1rXheI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659543429, "uuid": "be76f06d-55d1-4a7b-8d8c-251db5cc1c44", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659543429, "uuid": "05054e40-f31e-489d-9303-45120a5837d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659543429, "uuid": "c70fb3a4-c9b8-4002-b4f5-50b82bc086a0", "value": "52d12cdba1e96ce2bc18685e16c6904e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bb4d2d-1300-11ed-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1659512658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512658, "uuid": "1555185e-0baf-4fbe-8bb4-d4824d7def34", "comment": "Malware payload (BluStealer)", "value": "11e1af92f7cceed0e7b989b40c6be67e", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512658, "uuid": "77d74624-0151-4ce9-aa13-4b54a7bf03ea", "comment": "Malware payload (BluStealer)", "value": "dceab4eabbcf9787ac9a36c289afaa036782a24edd35523fb3072b030029faf2", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512658, "uuid": "873b66f3-d082-484c-8d07-701017ce2217", "comment": "Malware payload (BluStealer)", "value": "31cb4829e6ded8a4633642cecf5c42a4fbadc1b2", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659512658, "uuid": "482f6c72-59b7-4661-a701-556265e18dcb", "comment": "Malware payload (BluStealer)", "value": "0f751c4c2a3ac921e2d22db2a6c88d882880750ac25e401605f7175f46ab07c839f19f0ccc8fc61d2fdc70fa00fbb216", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512658, "uuid": "ac5cd538-fc4e-497d-95d4-e99649ff1f5b", "value": "T1BB73C58C7A5039CFC85BC9729EA81C64AB60B477971BC243E05751AD8E0CA9BDF191F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512658, "uuid": "c709dd78-15e1-49ca-8c75-949f6d848a2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512658, "uuid": "bda5d67c-34d1-4b1a-a7ca-f2fe68748e2a", "value": "1536:o6Dz+mVYsCsxyA/oJN77d90NktVCbczEdUfj:BDiGvCsxyA/oJNvdoktVCbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659512658, "uuid": "2b1047b5-6c54-443f-904e-7d4d9059e948", "value": 75544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659512658, "uuid": "0df1d2e1-0692-40f9-b3ee-b5ffd432a86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659512658, "uuid": "76dd6f46-daef-4ff4-b376-988c55c0820a", "value": "Micro tunneling Drawings.pdf1.4MB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d8a961-1360-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659554076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659554076, "uuid": "5a75b03d-5b8f-46f1-b376-248fac5f5f64", "comment": "Malware payload", "value": "e49be69a3e1e55ff2e31cf2fb31eade0", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659554076, "uuid": "216539bb-96b8-4ba2-8032-0e43d97c68d0", "comment": "Malware payload", "value": "de68182f1e561c7416e24829bf97d7d089bdd8932f881734eeb2b02896e80d3a", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659554076, "uuid": "6a538c41-b1a2-4b4e-9731-5b34bff222bd", "comment": "Malware payload", "value": "84c2d874d0f48fad4fb58c5841d5f2641caa6202", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659554076, "uuid": "96981bcf-489c-4e67-b29f-c8c20540c9b4", "comment": "Malware payload", "value": "004cd68dc32850a04b0180ace75d9041a9323bd1ef6f6362f5901dd224617e65fa18d637be4fc4423de221a6b3872fb0", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659554076, "uuid": "39d9b2a4-e018-491e-97a1-afa14c811c09", "value": "T112E14CC8DE94ECD661CEFEC9010FFBCEA932EA1A4050150A157337F0E5B266E5A15AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659554076, "uuid": "8d09dbe7-1153-4573-8adb-819cd65672d5", "value": "192:3UeupWKXGiIvDw0NnzLsp+Cvz8dleI3hock+EZfY:9up7XGicDTNzAkOKhXk+EZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659554076, "uuid": "ae0d94fa-8515-4bd5-b6ba-709ad14eb41a", "value": 7003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659554076, "uuid": "f94b2441-26e8-46b2-9700-9d615e071120", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659554076, "uuid": "a74212f6-a93e-4197-a3db-d6075f3fda93", "value": "35-EXPEDl\u0190NT.\u0190_.42lkns7wMC563OTCyFiOop5D.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0a790c-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522552, "uuid": "355bd22b-1c1c-47db-affc-fb2777359ef3", "comment": "Malware payload", "value": "7ec347c27cc590bcaf897f0933c77747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522552, "uuid": "ebb4ef83-05f2-4549-8a09-6fc00c9607f4", "comment": "Malware payload", "value": "df50e9ae62a46bda93ff03d76b707d574a3803754a782e21e4b9ef547f7ca32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522552, "uuid": "d28fc744-4f76-470a-981f-c7b798742d20", "comment": "Malware payload", "value": "d6f1a8fbeabff210368e5b24dcff4c96158406c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522552, "uuid": "090f6898-96bb-4c72-afee-a9a22e6d4dfb", "comment": "Malware payload", "value": "cab29bb11d0fb1eb20bb7acfc9ef10509c92cee476f5bf665a93e750fd4803fcc50cd22f7be99556a2133f9f43174e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522552, "uuid": "c0c49ea1-83b9-46e8-a7fa-34986d001942", "value": "T1181601A9F1002EADC03F06305033A998F2755D1A1FA9C667B2FA7795FFFB1A15D02906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522552, "uuid": "8a7fdff0-3f3e-493d-8e4d-bc4617bb6df6", "value": "169ed3b6d7e392d08082c1177313c982", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522552, "uuid": "f0c8a3d4-bd06-4e51-9122-29a24bd28f35", "value": "98304:B68qgX0MLIx3dV+4qjulk52bDu2MBWxj3a7gnc9tBm1v:B98dV+4qjIEaq2Ygj3artBm1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522552, "uuid": "bffc109e-86bc-4caf-b0ed-f5ebbf6d21b1", "value": 4407296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522552, "uuid": "7eb4e068-01dc-48c8-952d-f1caba38f5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522552, "uuid": "0e3d1926-bffb-4833-9b0b-4036d37af669", "value": "df50e9ae62a46bda93ff03d76b707d574a3803754a782e21e4b9ef547f7ca32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0c7020-1316-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659522339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522339, "uuid": "bce2bb82-112d-4f87-87ad-b0bc954df56c", "comment": "Malware payload (AgentTesla)", "value": "2de023032f1f87a7ed648c32fcf484df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522339, "uuid": "94802cc9-34d0-4fd7-ab0b-a5fbc5f523ea", "comment": "Malware payload (AgentTesla)", "value": "dfd1179ad73ebb13661fe68ec9276f503563ec578c20c1e6489e2d3666deb4cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522339, "uuid": "9f6236de-76ad-4128-841c-848086c8df02", "comment": "Malware payload (AgentTesla)", "value": "17be3627191cd82331a205cd3eca02380d541aba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522339, "uuid": "7adb1e38-0588-4732-88ee-d964d8018636", "comment": "Malware payload (AgentTesla)", "value": "50a8013c95c14b543588928975fe26973aeb32ddb102061115d4a912e909361304fd35014bea31336d6562b139dad212", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522339, "uuid": "29807414-eedd-4a92-af39-a7eb56795aa9", "value": "T1A8E4128122BE8707D4B99FF1B92080864FF5A16B1426E28C8DEE3DFBA176B530751563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522339, "uuid": "3438ba6c-96f8-4749-892a-a5044c1f3eeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522339, "uuid": "f85f7aab-c9dd-49ff-b4fd-d30e77488047", "value": "12288:+g6SKlpxw+nFxH3GPRSRXlAZ/c+WOXovsigny2tzy4:8LlpxHbH3URyy/c+WoovsX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522339, "uuid": "42cec0ad-f460-496e-aec3-3c2e042fda03", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522339, "uuid": "cc52c3eb-75f3-4f58-bb46-1739e2f8efaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522339, "uuid": "53cb9fd6-2d08-4219-8213-a962a78af599", "value": "Swift.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcf0278-1374-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659562817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562817, "uuid": "bdad3d0e-9cfb-4a0c-b9ee-bc3fbaf8990e", "comment": "Malware payload (Stop)", "value": "73c11e98096c6b0e8929ed7c2536756f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562817, "uuid": "5f6dd86e-441a-4326-938b-5c00f7c2a86e", "comment": "Malware payload (Stop)", "value": "e008b3b61d0625feaaa80cc6ed0bf86e7d392490c4b67244ce4d2b59cad44521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562817, "uuid": "480a8816-fb63-4730-81ab-b799be369cc6", "comment": "Malware payload (Stop)", "value": "b5a775774c7e2d676a66fdbc487d156dc7e6bafb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562817, "uuid": "f3834b5b-538b-4035-bc9e-e302f97dc155", "comment": "Malware payload (Stop)", "value": "2d610dd31ce0ed9c9572924a7ddf313d9628e4305e3b28bc370ea4586a4acfd88f16a1bb02306d5f8e5ea3746c081803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562817, "uuid": "c8688a86-70da-4e2c-96a0-dcf7161a4fcf", "value": "T152E4122139E1D072F87795314965F6A20BFF7A631B70488FA764263A0E667C11F3B362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562817, "uuid": "98eda87d-c218-4f80-b2ea-1c32749e5e90", "value": "a8692768e915e3ee244bd5d51d7bedfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562817, "uuid": "ae6c40f1-b890-4065-858d-47132643742a", "value": "12288:YWYO5FtCT7eo3RK5BqwgnnAswjCdyxSSchIm630+qczjMNhvPgHMK:YvcCeW45p4iCwSlUtqczW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659562817, "uuid": "d2bf231c-1720-4fb3-afa9-f8ac014fd796", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659562817, "uuid": "e1d0b02b-3ae8-4673-a852-5a3bd79254b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562817, "uuid": "2959edd5-2c8e-4c31-a3aa-020630beacb5", "value": "73c11e98096c6b0e8929ed7c2536756f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51dd4c4-12e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1659499640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499640, "uuid": "1fe54744-732a-49a9-8230-40b091c05bda", "comment": "Malware payload (njrat)", "value": "f09845a7b617f093887d29554e795081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499640, "uuid": "504318d2-f102-43a4-985a-ec84fffe3812", "comment": "Malware payload (njrat)", "value": "e10753f08dd4399bfb6de99a86ee12d32aaac6eb6f42da26055a1abc26043650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499640, "uuid": "2c6b95b0-c735-4ec8-be0d-d5d914b4e0ba", "comment": "Malware payload (njrat)", "value": "90fe8bd31ed126fd5dcdd292e0054e0a6e2e70d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499640, "uuid": "0cadf945-784e-403a-9350-c969cf78a804", "comment": "Malware payload (njrat)", "value": "df1054f420de7291e633780a00f3a8384dc45f183152aaeacc361de456070d5c9a387295b9b30afc5927abe1d41b832f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499640, "uuid": "4a229f67-2224-4b0d-872d-a7b0afaa50a9", "value": "T149F2F81837F28721C5EE17726962D36312F1E2136522E71E0CD5B8EA7A33AC50B49EF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499640, "uuid": "94d475af-11c1-4c33-8d96-545cec7b66e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499640, "uuid": "b6c95e2b-bdb1-4594-8c89-61afd02daeb5", "value": "384:kkXBMFrzNnVivPT7mLt2vl8ne+mzPLTCn2Ie2UeYG0odLtIanrEp0L:lxqrxW77mxc8nTP1hneU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659499640, "uuid": "136c4c39-f934-4c6b-888f-417ebc2fa2ed", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659499640, "uuid": "4d9ad9a7-a295-4040-8a72-30d46b95ebe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499640, "uuid": "5984ccb7-017d-4592-a9f0-90696129072e", "value": "bDTn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078fd2da-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1659511777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511777, "uuid": "6641607a-24b2-49c9-9385-781b686aed54", "comment": "Malware payload (IcedID)", "value": "fdc1bdf5fd4fcacf23ecf24ee507e03e", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511777, "uuid": "efae8156-25a0-4cd5-8faf-121968611364", "comment": "Malware payload (IcedID)", "value": "e15f166220a800acfdf7a8df1c7a1bf441d4326347905a2e595ea988f0bd6c91", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511777, "uuid": "76560d21-49c7-45c6-b4fd-d48845df919a", "comment": "Malware payload (IcedID)", "value": "02deffcc2b930d5c49a6d26e4e713f210248e1de", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511777, "uuid": "809bbe0b-d280-450f-b4e0-2d470a557bee", "comment": "Malware payload (IcedID)", "value": "9406a2ed257ca91c1c75d3569c1331eb5778eb37d7daa21b9f425580458aad816865c5bc2591a807b0457e880d9c7d4a", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORWARD MUSIC AGENCY SRL", "colour": "#68E46C", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511777, "uuid": "bf6f7f2c-0522-48d2-8eae-7b942b6be0ad", "value": "T1DD044A5DF3013856C1AB927400673A0B62336A19AB49C88CB53C9FEA1B7ED54727BF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511777, "uuid": "acf6974e-365b-45a1-9098-ec205085bb0b", "value": "3072:+LUDvzipNOnSwH3FWur1LOj1nB3SWmRbOOLOVk6ISFKC/Ukw:JDziix1WuJL+WCiODRF+kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511777, "uuid": "1202bea9-a006-4836-98ab-f6f33010e6b8", "value": 176024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511777, "uuid": "52afb052-c57b-4b44-8741-0c47c19cfcbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511777, "uuid": "38fc31dc-13aa-470f-99e6-7f3416db59a9", "value": "b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382c3294-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511859, "uuid": "db5eaa98-1ecc-432f-8148-354b477901c9", "comment": "Malware payload", "value": "b21b704519bd239212a4afdd507b0ba8", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511859, "uuid": "4af172cf-9fff-4dd1-980a-80c87b05be33", "comment": "Malware payload", "value": "e19fca78d27ac1301d454c888cac0bbd45c75a909f7dd7a0e45a424c2e21ced2", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511859, "uuid": "fbb762be-c805-45f1-baaf-fcde4f2e5903", "comment": "Malware payload", "value": "a51a7dfda6cfdaf16a09a5c0b6174990fbff8b10", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511859, "uuid": "f37476af-e7ba-4b42-a04c-26e15b26f6be", "comment": "Malware payload", "value": "c4732c0186724a3d5c4e7d3d0e85e30e90b2e420e76f2d0819040aac690af727cab6f893bb8506af8aa1e13daea98d2b", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511859, "uuid": "f2485eba-8555-4ee8-b3c6-928dd8a45e96", "value": "T1B1026830BA66A567C777E210F54B6D537A3B12C368A48B8177A7202F54F3407943E2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511859, "uuid": "ed41d558-532d-46a9-979f-231f2ca3e164", "value": "96:SMnKYb6Xn9RSWRMclgz/wwfKlnHl0AHNrCCeYFlKlnHl0AHNrCCeYFWXn9RSRYd/:UfIq1xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511859, "uuid": "28940b2e-0971-46bf-942d-1e3dc648b325", "value": 8685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511859, "uuid": "e3f88818-2485-422b-bfd4-0bcf1d77b425", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511859, "uuid": "b7e7d417-28f0-4f44-a517-31148e6a2ac6", "value": "newdef.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b32da5-130e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659518832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518832, "uuid": "829639ed-46de-4293-8e46-1397858defb8", "comment": "Malware payload (Formbook)", "value": "55c95ec76d0e82a88789859d2a7ace01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518832, "uuid": "bd6cdf0e-cc9b-465d-9af7-1304166f728b", "comment": "Malware payload (Formbook)", "value": "e30fc87ce3075c2d3cb6abfb9a3f1be26d8285b3aab8143787e0dcf976508af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518832, "uuid": "9aa684b5-0a61-490e-b021-db165cd401f6", "comment": "Malware payload (Formbook)", "value": "bb9b27416b30bddf133203e748acf58679c76dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518832, "uuid": "96904a6b-5718-4db7-98b7-317877807e6f", "comment": "Malware payload (Formbook)", "value": "c938993a6fd796f5b128b08081670616735870791870d5226f502645d6441dc60711e3f7aaf9853ba9aabab384d6dd28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518832, "uuid": "a79c59c2-f173-4b39-8653-081a8539f9b3", "value": "T1FDF4AD2231C5761AE03A4E7787D094A85BB0FD12F31AE5662DA13387C7F7EB08D56D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518832, "uuid": "3ede0b8e-a867-437b-93cc-730162ef3d28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518832, "uuid": "7d927850-c2e3-4bad-9bd1-4b27aade7542", "value": "12288:wkmugWmOhLuyAH+2iNsLWwxiz7LLwSrdGwnPhKb1IgYzIfOIyGF:qUhLuyy+1gwXRnkbfYs9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659518832, "uuid": "9816ea33-1ff2-4d8e-980e-30d63d9fe01c", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659518832, "uuid": "e5585f84-678d-46b4-bad2-eb96adde3b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518832, "uuid": "95a222a9-dc0a-45a6-b353-bff4c43dade1", "value": "SHIPPING INSTRUCTION DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ce68ff-1318-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659523102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523102, "uuid": "b7b8f966-1c9e-4cca-93b7-4729cb8604f8", "comment": "Malware payload", "value": "b346498bf38bada810525294a72919a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523102, "uuid": "0cbe8fa5-1b0f-4610-ab8e-70f638d13f49", "comment": "Malware payload", "value": "e39038be57376d180fbcd810c01dd4d1312058dc7507cced7acbbe1d5f926c22", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523102, "uuid": "3da76eb8-bf5a-4e7a-9c95-d6857f7db7dc", "comment": "Malware payload", "value": "db9c3bd034c736d6e1a55735c6ed191ccf89a1cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523102, "uuid": "9c993e8a-8233-42b6-b2ec-d08db2dd54bc", "comment": "Malware payload", "value": "50eea9c003222ca3d6e140878957f58ede81b9d6c40200160c1e0524e5446e681999a9a197ddb562500e73ab6a2f1363", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523102, "uuid": "20427f51-659c-4a60-aa7e-ed43408e276f", "value": "T1C9527C7CE15C9ECDCB8EB3D6A7073E5D05BFBD0403D6D19165ACA7642F021AE460B8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523102, "uuid": "c97ba1b0-e601-4641-8f45-46d8262bf1e6", "value": "384:G8kzIWUTGCjwpZ+hwgQl2ELefT7EnM0zuDl267k:GOW2zc1gQoO0T78M0il2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659523102, "uuid": "9c9433d3-c8aa-4d76-89cd-527f4a4ffa3f", "value": 14092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659523102, "uuid": "e8cb4772-fc1d-48ce-bd18-bc7776dbead5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523102, "uuid": "cbb2030e-c50f-4dbd-b8e2-5d07ba3b349a", "value": "TT773662.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8102c07f-1332-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659534315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534315, "uuid": "d84a68be-fea0-4557-a1f0-34c816f03afe", "comment": "Malware payload (AgentTesla)", "value": "f725889026991a6ef5ebded030670a6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534315, "uuid": "074ea9d5-41bb-4fae-802b-09a2a4638a84", "comment": "Malware payload (AgentTesla)", "value": "e47ae67b881ebb6ba57dc6ef1d603062ccdeac87bbcfabe47f9058678a31d7bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534315, "uuid": "0755442b-aed5-4e6c-a26b-e727ad6fc7fd", "comment": "Malware payload (AgentTesla)", "value": "0fce3f9809cc56af478b5657baff258be52880e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659534315, "uuid": "66a9f861-510d-4825-8262-9dce64aab0de", "comment": "Malware payload (AgentTesla)", "value": "c682bce0024ee8e6d489a5d58aa268b1cd537fecf5f98ba7d01c857d033328234a2ef614ec1066184e1071d7a7e756fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534315, "uuid": "4a939ec2-a84d-4105-a98e-ab6b431c9d21", "value": "T1CD158C2931D5B14EE02A0E738FC4B46057A0ED26F745E91A2DA6334FC6F3A704C5AF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534315, "uuid": "935e91fa-ecf9-42ce-b3cf-db337b519f25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534315, "uuid": "4dc482e0-7bcf-4044-bdb7-206d6d60e52c", "value": "24576:EBhLuyyk1J9qbf4nOOIn63DcEkx3gLLY8:4LuyyktqXnMDcEbLLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659534315, "uuid": "1f9a2970-b176-47ed-a597-f2418377ea2d", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659534315, "uuid": "a260b1fd-bc16-46ab-be19-a75a205365c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659534315, "uuid": "a8fd24ba-b756-4ca5-bd66-a6c6f1206b10", "value": "SHIPPING INSTRUCTION DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38310f49-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1659507564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507564, "uuid": "f3186f20-e07f-473b-a613-4129cf77f74b", "comment": "Malware payload (CobaltStrike)", "value": "8182dfa35d62d96e00e5423aeb96bec7", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507564, "uuid": "60cd3be8-bd30-46c3-8400-de1151108cc8", "comment": "Malware payload (CobaltStrike)", "value": "e50ad2c7d293e2b61323208b31785309ae250ccdb7c59dc5d8e3af7df45b6fba", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507564, "uuid": "173ca43c-c87f-404c-b5c6-c5f22a823bed", "comment": "Malware payload (CobaltStrike)", "value": "c00fb05045d7255846d406fb1ea60371969dce40", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507564, "uuid": "14f559bf-378c-4393-b4c4-464b12fa7ed4", "comment": "Malware payload (CobaltStrike)", "value": "565ec1b2881ac194d28a97314274093dc46b5297720f454f02fb55274e56d26a4594b83746fd5b7232066aa0e59277f6", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507564, "uuid": "783251d8-5289-43c2-a65e-0b015b018039", "value": "T14A72B55E3F1788EAC20ED4F498EB8B357679BE530D91573D12A0E6322E21B919B3D124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507564, "uuid": "38c34e0c-594f-45d2-82b7-105caf390de0", "value": "6b83b0ebb6697b96bd553d8b94e79505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507564, "uuid": "24f659a9-bf8c-479b-a48f-bfdf2649779b", "value": "192:Shpv73DjxV7l6T5PXUhYDiNJJzuMH8tMd2mMPPlJjzEzN+qn:ShpvLxfyPXNsJJHEPPPbjzSNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507564, "uuid": "eb55b711-16ea-4e65-851d-32c5aad1199f", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507564, "uuid": "9653acfe-f9ed-4119-93ac-1881a6ee3c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507564, "uuid": "e1fa4de2-00e6-4fb2-bd0d-4fa8a21ed804", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c44371-1381-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659568384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568384, "uuid": "6f081b9e-36d2-43cd-a27b-68b6342a59f8", "comment": "Malware payload", "value": "69018002d42f826bb5568b0a213aca51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568384, "uuid": "84e36d31-98f9-4f7a-9a61-74af214938e5", "comment": "Malware payload", "value": "e5d8ffdee56939a09d683d73417461169a52d6e44884beb73f8ff03dcf9cebe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568384, "uuid": "3aa7bedf-74f7-46da-87d1-08baafe0862d", "comment": "Malware payload", "value": "1458e0803f3628dc85b905672461d6acf4290e82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659568384, "uuid": "3d79af4c-03f0-4e5a-9cdb-6f12fde0ec4a", "comment": "Malware payload", "value": "9ffa8624db9875bcd5a2b6085e9b643334fae0588c198c9ad4bbc06d16a4d3746e2925abe62ab8b760d8ef7ddaad2518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568384, "uuid": "f07e36ff-6406-4133-a5d8-e274d9508147", "value": "T105F5E001BE40CE21F0191633C2EF455887B4AD106AA6E71B7EB9376E55123E7BD0CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568384, "uuid": "b6219a78-d3ab-4f47-a2d8-63e6c2b5b963", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568384, "uuid": "bb9cb753-ae38-4c50-84d9-acb4ffec9750", "value": "98304:UbwIfHDYKwn4PNHNq1IS6v5Dy9qCdRaQJ:UsZePqyVU93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659568384, "uuid": "3e9478b4-1d3d-41ca-b45e-5f66d316fbbc", "value": 3438223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659568384, "uuid": "20ea57b7-a74f-47e5-a327-6c2a49c7de32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659568384, "uuid": "71d53d94-27b8-4d1b-aec0-a858e3b2cade", "value": "69018002d42f826bb5568b0a213aca51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f5d2c9-12eb-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659503881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659503881, "uuid": "defb3a37-88a4-41ec-81ce-0475cc8659ee", "comment": "Malware payload (DBatLoader)", "value": "d898ec314df386d53273beae1740c7f9", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659503881, "uuid": "c3f75375-4155-4bf4-a0b2-1b75539f9758", "comment": "Malware payload (DBatLoader)", "value": "e78e1baff2d7a3f921993ef1537adbed0b4cead4154cc42c2bd760ace1dce46f", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659503881, "uuid": "c8566e58-88ae-406b-b8fa-5af9b01d6318", "comment": "Malware payload (DBatLoader)", "value": "48129f3aa13df929f1cb8ed23980eb350473d637", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659503881, "uuid": "82800087-ef8a-43b9-b7aa-3d20f260ad26", "comment": "Malware payload (DBatLoader)", "value": "a9973930e7ec0fc0c8b6dce7d4cfb12f4b356771c9202b0ca70af14001296d21ad991178f810f00cbf671ad62996e19a", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659503881, "uuid": "6ec91f0d-6284-4ea3-a14c-307002911bc8", "value": "T19E259E2A62908437E0672E385D1B57F49D2BBD112A3898462AEE3E4C2F377513D353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659503881, "uuid": "b2d52071-69e2-445c-a3d7-0d25269af185", "value": "5f2a5ba208506b49b681af6fe077e44e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659503881, "uuid": "d34a4d15-8f52-44ba-86ab-fd0945e075cc", "value": "24576:Jeq1bWjPd8Y5Q0MFxdNLdFRlz8d52Ep8rRU:JeLValFoorS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659503881, "uuid": "972d763d-75a2-4810-b3d8-d7b1ac42dbc5", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659503881, "uuid": "919aa902-76d6-4f41-8413-0d2f379c31a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659503881, "uuid": "4f8888d3-b247-47ad-8534-9910b7127b59", "value": "order.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7f29b8-1384-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659569338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569338, "uuid": "ca8fde62-7331-427b-bff1-68306ae31109", "comment": "Malware payload (RemcosRAT)", "value": "f543e0f7da1b42fdbaacf6817fa57db6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569338, "uuid": "2dc3745c-e318-44b7-baff-2a3a56457f7a", "comment": "Malware payload (RemcosRAT)", "value": "e7a3522e5f2bea8656f4a586387628402e469f461e23463459c69dc3274c39ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569338, "uuid": "38136233-9998-466e-b1a5-0fc4192cedc6", "comment": "Malware payload (RemcosRAT)", "value": "31ee60745d4d5acf6bf2d1d9947e7692db831013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659569338, "uuid": "60197438-c8d9-453f-9353-95f3f009f65c", "comment": "Malware payload (RemcosRAT)", "value": "0c48d13c5946328315e077b9cd6ea5771b0aa264b10fb22ca48e3563a8b389db2da77286e48b7b905a50092523073185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569338, "uuid": "d2acd460-af05-471d-8267-85c59b1930bd", "value": "T1740486E0B2964A52D6C07239AFE2D3F11361CF9C16168B6529F17E2F7DFEB635840260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569338, "uuid": "3210c295-222a-4f03-8d37-49f66d87b79f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569338, "uuid": "1a8a4b46-db46-4725-b1a7-bab37cdd38af", "value": "768:V7cvsFLy7OXrd/OlfbsSNrueOXyzfKtdBJPZkDDbj7IQ60paGP:5UceMxy/6Ksd+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659569338, "uuid": "91e1558a-d653-4124-a40b-a3051f091d78", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659569338, "uuid": "926338d5-7bd2-48de-bdc7-09974fe509d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659569338, "uuid": "69ccc600-481a-4087-afdc-d23c5ee39bbe", "value": "f543e0f7da1b42fdbaacf6817fa57db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450fdd14-1301-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659513169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513169, "uuid": "9d902ab6-384c-401d-b96e-f5f9ab93a64c", "comment": "Malware payload (AgentTesla)", "value": "e9b4cd70479252690cc73bf36978f3aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513169, "uuid": "8e050c5b-9f15-48b5-b9bb-19a271f90460", "comment": "Malware payload (AgentTesla)", "value": "e8874e8aa87df4ff11c3b8aded326db750d853484ce24f216a1b8d49cbd95aa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513169, "uuid": "1d71e5fa-704f-43e8-9ae1-f7968b59a331", "comment": "Malware payload (AgentTesla)", "value": "a69147b7903e2b468cb7fd0e50d8e2a365f18112", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513169, "uuid": "ad762a93-c0d6-42a7-9c46-152ff3427c90", "comment": "Malware payload (AgentTesla)", "value": "12d8654e93cfc3d9b23005b4293d783e631d9e8c7e8e0c9cb0156ec2d774de1067144ed7a7debad1a1e6665bf629df35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513169, "uuid": "ac640e67-fb31-4cf2-a6a3-2e24b76a5661", "value": "T1D2F4AD6224D6721AE0394E3787D094A85BF1FD12F709E6662DA5334BC7F3EB08D16D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513169, "uuid": "e00639a9-5486-4de2-a77f-e2024e963020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513169, "uuid": "bdf323ab-9554-4d80-9bfe-e64e9b8de73f", "value": "12288:SnumWmOhLuyAH+2iNLvAnjFK7Ad27o/Aoln3yKDZ10f:4UhLuyy+19vAjFK7L+niKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513169, "uuid": "c4c474e0-4029-418d-8a87-06114a888b33", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513169, "uuid": "bd3bb462-e308-4fba-956a-a1461906ec85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513169, "uuid": "fbad2e31-6fa7-468d-8ab0-0c02fcdf51af", "value": "BANK COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d19426-12e1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AZORult)", "timestamp": 1659499369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499369, "uuid": "f83a28d8-1ff2-463f-8dce-edcc88bf1f98", "comment": "Malware payload (AZORult)", "value": "085b7c931de2158749766e0739a029f6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499369, "uuid": "8c30baa4-4f7c-4b4b-bdb4-bf6e9a564674", "comment": "Malware payload (AZORult)", "value": "eaba8851c1f322461a569ff7b7cd06959eaf767d674c0958eec5e56f341b2054", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499369, "uuid": "395ee25e-ecc0-4fe0-8b97-b930012d0277", "comment": "Malware payload (AZORult)", "value": "25bee38e68a72f1a41a232a0943d83c8c1584215", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659499369, "uuid": "41754c85-e6e0-4545-8c40-15ac9f8cec96", "comment": "Malware payload (AZORult)", "value": "beee5d9b0330034d8cf5eab8765e5d0c74139b7c534d9361978efbe1c410bc49acf5ab01e045c0e4b75bf78f375efa2c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499369, "uuid": "0043f308-13cf-4665-bc12-0dd67dae9382", "value": "T17EF4E01177A58B07E4B64FF5B4B044105BB3B62A7023E35D5CC938EA6DB27438A1BB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499369, "uuid": "40f7574f-7e8e-466d-b67d-2152e3d4e034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499369, "uuid": "f349b313-7085-487f-9771-779ad09e095b", "value": "12288:CkV0g6SKlpxkq9S+xQUfhfL0uLI0CQJZ3EeNl0TdDoGl:BWLlpxkq9dxTfhfLnLI05Gk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659499369, "uuid": "9a044dad-dfde-45a5-80bf-f65d3fca7ceb", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659499369, "uuid": "2d088156-6e4b-4ca0-b7ff-6fd3dddfcef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659499369, "uuid": "cfb6a5f3-9d32-4cf8-99c1-2131db62a72d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.23090.8673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faf2d3a-1327-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659529588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529588, "uuid": "d89e7dd2-20a7-48cd-a412-93c1ab1f249c", "comment": "Malware payload (Stop)", "value": "b112ef1126a3046d945fc1117ae75540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529588, "uuid": "1296acf1-ae9e-4070-9173-f8827ab2bb75", "comment": "Malware payload (Stop)", "value": "eb8444e6d256a2383c2b942e408769c6791479197fb03d736e6ae66538251e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529588, "uuid": "6ff0a52d-86e7-44fc-928e-3c9938e3951b", "comment": "Malware payload (Stop)", "value": "6bde3dd8b802c350b2ca0c22696900c3753dc68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659529588, "uuid": "ab09ffe3-1937-4243-9189-ac5f382a886c", "comment": "Malware payload (Stop)", "value": "0e4b35bbfbbe8c9a4e45fa33097733e19b6ef73f7996bd433b413ba028a4a7dc9a5e6d5d9e74b748f914aeefb049eb4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529588, "uuid": "3fdbc52e-c183-4e8d-ac36-d494232564f4", "value": "T17BE4122232E1D4B2E1A77930D478C7A1597AB9731AB4798BB39C173B1EA03C15E78317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529588, "uuid": "4d95344b-b831-44bd-8b8d-9063a42e6db1", "value": "19d26450af6fae284e6a28f691d90382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529588, "uuid": "0a53025d-e4cc-47b9-93a0-c77e91c51953", "value": "12288:ig9ROm9yGsZT943baFr7hRwZi1r+iLoHBD6SikdaPsqrsheIiF7L:iYRn9yGsAor7hRw4t+iLohmSikYPohM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659529588, "uuid": "a562c4fa-2c13-48a6-bb9a-83efea178185", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659529588, "uuid": "c4578541-22c9-4dd5-aa93-a9ba116940e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659529588, "uuid": "3dd7d221-31e1-4ae1-90cf-bafa5188dbd6", "value": "b112ef1126a3046d945fc1117ae75540.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153d4651-1317-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659522537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522537, "uuid": "3d7ebb9f-ddbc-4594-b16e-fc83d91214cf", "comment": "Malware payload", "value": "bede1b60932c3176bfcfb1f04d9cff9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522537, "uuid": "c177de2c-4bc8-44a2-869b-4812eaafd2ee", "comment": "Malware payload", "value": "ecf763f4bacb053f371a3c84421af642694013c2a3ed2a451c8269b1ab2d71ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522537, "uuid": "d533e62d-db4b-45c0-a070-a5fc9e2c9090", "comment": "Malware payload", "value": "160adb6fda866cac0231daea654d4aa8843c23e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659522537, "uuid": "4fad7aac-032b-4249-860d-4b8cab19a52f", "comment": "Malware payload", "value": "44e385dcdd89f1eff3944ac54727e25b2e97e990f90c46ac7d64c803f7e71c2f0febbb69532258010026f4c86edbc13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hangzhou Saifan Technology Co. Ltd.", "colour": "#2C5A1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522537, "uuid": "bce379cd-3f2a-4f06-a74f-5273b3101259", "value": "T1AF7512C2ED581A76D4721BF09023A4BCE4B50ED12D38D57B43F1B6A7F6F22A1593A183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522537, "uuid": "0a5b49f5-91b5-45df-9cd4-bb5118039fda", "value": "a00164459a73eecbdd307551bd77b018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522537, "uuid": "e5a6afac-cfd8-4ec6-b7fd-4ca95d31feb5", "value": "24576:3DaZLRX5ojPBB/D5HeV97FjAqDq2rTNXc4iDb+etf6JIpUHDpAqIoXUOry:OZFmNu5lD7s4iX+ewqaqqIoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659522537, "uuid": "c2013862-4921-47be-87cb-44f9a057e4a5", "value": 1617920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659522537, "uuid": "0d690423-0408-46cb-b558-34abddfa3f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659522537, "uuid": "a52ccd6d-c99c-41b1-b2fe-d6fb89d9361d", "value": "ecf763f4bacb053f371a3c84421af642694013c2a3ed2a451c8269b1ab2d71ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd71619-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659542631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542631, "uuid": "a730e45b-8b48-41a7-8bfc-b135e1f7f34f", "comment": "Malware payload (SnakeKeylogger)", "value": "be9f4780502d0963ba72701185e27c6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542631, "uuid": "1c814d17-55ee-4ad0-826d-528a619f7423", "comment": "Malware payload (SnakeKeylogger)", "value": "ed88da647c0f630cf5378d7a246e643007ba0d2a96f4e54a96b293be6a55f6e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542631, "uuid": "3c0ec17c-b2ad-4e2b-8b9d-09c1d7bdae36", "comment": "Malware payload (SnakeKeylogger)", "value": "4c7625018981c675981e6d63485c164ab7936b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542631, "uuid": "0bbb275a-1e45-44d1-b6d0-07adc2b6036e", "comment": "Malware payload (SnakeKeylogger)", "value": "46174af21981cd63c8e27dccfefc4e3af1232005a3baa6ed85f78d1330566920155ef85e855773722bb9908fc8fe682a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542631, "uuid": "05a566d5-fb02-4d7c-851c-fb8a23d36d82", "value": "T128E412C136BB8B3BE0784BF9F56050855FF02A2B2661E6888DD8BCF799767030321657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542631, "uuid": "13fa3c56-5930-41cd-b441-5afe8d6667b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542631, "uuid": "646028aa-d63a-491e-af86-4e153bcd6b79", "value": "12288:2Ig6SKlpxX13lT/A7yJqyQ3unYjWJdyaaXtcck/:lLlpxX1VraOXQ308WJUaaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542631, "uuid": "d1781a8a-f265-4c91-8ee1-8652a7f3b67d", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542631, "uuid": "9a9539b8-9515-428d-a445-9565c01fa318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542631, "uuid": "10b58038-fbbc-4256-a69c-28e0f48c5067", "value": "be9f4780502d0963ba72701185e27c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47e3cb6-131a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659524120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524120, "uuid": "5de0151a-47c8-4403-9bf9-6f69a7e8ebfd", "comment": "Malware payload (Gozi)", "value": "8fcfb8f38d8607c57f08f9b39139065f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524120, "uuid": "7861ae01-1714-4b24-bb33-8569b5264205", "comment": "Malware payload (Gozi)", "value": "ee46bd47dbd009333a72bc752b3d38d5a87a25f90fef3d4d77515d4fd11f3c8d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524120, "uuid": "94cb3278-7f8d-4b3e-983c-c26426d3a625", "comment": "Malware payload (Gozi)", "value": "805bb719009145dcc32b5361abf5bb4d91015dbb", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659524120, "uuid": "fd5eaca0-233a-4231-ac0c-05481dc24e9e", "comment": "Malware payload (Gozi)", "value": "2a8b0b79de65e4b11529c508f3f4a0d06d024ed40ec8135a037aef858eb5efc666745814bc4d00aa467e4b51f8467eac", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524120, "uuid": "2c42230d-569e-4341-83a9-f56b056abd62", "value": "T1E3649E757500BCD6E66E56F7EA9ADDD8137266329D86E8CEA0607FC60463362EF01C03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524120, "uuid": "c0da9f49-7f62-4815-a109-8900a78db240", "value": "6144:afs+WIrCuGwcIfANlO3MGuH6AiT6nMIMrhfTtOwue9Lign7JEf:Ws+TCuhco3buH0T6GrhN7zFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659524120, "uuid": "e654098d-fbba-4044-a76f-bf01a437b572", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659524120, "uuid": "e772bcc1-b349-41b9-9861-ec04cff6666c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659524120, "uuid": "d18dfb64-13e6-4f2b-b568-e420f3168093", "value": "8fcfb8f38d8607c57f08f9b39139065f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e586de3-1345-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659542471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542471, "uuid": "6c0c5273-8ed9-4928-aba4-5b6dd5d8dfc5", "comment": "Malware payload (Formbook)", "value": "0f5965a9b9a3aa1af605dd71ec59aba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542471, "uuid": "8fe9df74-528a-4d87-af08-14df46062fdd", "comment": "Malware payload (Formbook)", "value": "ef776f82fa51452cb7b8c4b4e8ba7b66481f7fd6f5d36056081ebd1c3326cc68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542471, "uuid": "f9ec128f-0e58-49cd-b7aa-d45cb777bb50", "comment": "Malware payload (Formbook)", "value": "b478a197d262f09bcdcc69999d1a2b61380af0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542471, "uuid": "9d3acedc-865f-4239-9772-26bbc6b2336c", "comment": "Malware payload (Formbook)", "value": "b4a23485537698fb8adf1e17942f401e83bbdb3f161b06a1a5263516e1dd8264e98d4967e6d156ae4984711034a1576a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542471, "uuid": "3875811c-4b41-4380-a4f3-c3098d754659", "value": "T1B405022BB3DBCF03C1248E39D1C71D9003BBD66E2673D35AADAD2B7655433264A82746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542471, "uuid": "a845c31b-8683-4dbf-8505-d32ddef5913a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542471, "uuid": "49e90c6b-d754-452c-bfae-fd3ebf8038d0", "value": "24576:0jgE/LlpxGjLMoCfeWdScxj2QH1NTAsP1UbQyA3:0EEJGj5CDdj2QV1Aq1UbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542471, "uuid": "a23a78c5-c43e-4ef9-a9cb-5cbf15a443e6", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542471, "uuid": "847df9b5-3c34-4c15-bb0f-9574808c7b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542471, "uuid": "e4a7d081-57ef-4b47-8717-d1b45ed6ab1b", "value": "Remittance_90523_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1526818-136d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659559736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559736, "uuid": "e9e24722-d83d-46f0-9dee-0a036ba9bd49", "comment": "Malware payload", "value": "275de9d86dbb77e62af70b884afccefb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559736, "uuid": "38a30bb2-5b74-49da-ab2a-6dfe9647a680", "comment": "Malware payload", "value": "f015f9eff38e98d22e71c8005e61f69138c0747f759333af66bb2ebd545ec192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559736, "uuid": "179cd4be-ea82-43b3-b1ee-a71b020e425d", "comment": "Malware payload", "value": "ee5352110513fd440c6b268b26dfe45de9a2e14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559736, "uuid": "47ffe322-09a0-40b0-9cbd-2b49f7fdf14d", "comment": "Malware payload", "value": "858ef72f95cc2e01908ac22c277315eba5e727c1db82e3ffbdb7d0424982fffc881bacbdca0d98912b38a9479ea79758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559736, "uuid": "7d64b7b4-3c3a-4955-b944-2ebb7d63c820", "value": "T17C159D027391C062FFAB92734B5AF6115BBC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559736, "uuid": "a9154e51-3ef5-4eb0-93c2-11c075fd7cc6", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559736, "uuid": "93b74a58-f90d-47ad-8e94-d7c0274b21cd", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMXaBi:DPVt/LZeJbInQRaMXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659559736, "uuid": "483331b3-cd7e-40bf-b7f0-a77872da17bd", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659559736, "uuid": "2974d202-ecea-4f09-a353-6281277a1277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559736, "uuid": "6e5c27e9-de3a-47c9-ba9a-7a1e46e53cda", "value": "software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196d06d1-12c7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659488185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488185, "uuid": "2021c697-9213-4bc4-af56-baf1832220f0", "comment": "Malware payload (AgentTesla)", "value": "a2019494feabcebd005f0f70e2b7249f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488185, "uuid": "9c208637-3f6b-41a8-9b80-1b8918072d39", "comment": "Malware payload (AgentTesla)", "value": "f02390c4415b1938c51f3c3537efe414fdf7642504936233f195fba5c6d6a6a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488185, "uuid": "b3c088eb-229b-45f0-9752-a7cca4d8b085", "comment": "Malware payload (AgentTesla)", "value": "6c778e48a8b042b24a3ed7f85670d65509521af3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659488185, "uuid": "ed705636-7d0a-4dca-9995-1c9aff5b949f", "comment": "Malware payload (AgentTesla)", "value": "304d971a044e275aef79a1425c4d1213d78b986323564d5ca816909e384e12e2b74360709a739625d06f903ba7051858", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488185, "uuid": "b30f6b58-4d1d-4fcd-8b0c-084f2d3eaf59", "value": "T10D15016FB3DBCF03C1649A7ED0C30D5503B6C66F9233D341BAAD2ABA59533A64990349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488185, "uuid": "77716e21-665d-4c87-8d5e-bcae18118663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488185, "uuid": "4ee3df13-b06a-46e0-86e2-9d34e209a80b", "value": "12288:15MDKxg6SKlpxyb0bIHENAonU5zGe3rcVYMvo/E0ez7ZEoATFL69yn7cOERgz:1qK/LlpxyqIHq0yKfMg80OEoATFQyA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659488185, "uuid": "386197e7-72b5-41e1-9244-392a18d38f5b", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659488185, "uuid": "127da93a-1540-43c4-b58b-655e99feab4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659488185, "uuid": "c02d60bd-6d9a-4f7e-b575-c5b53666982a", "value": "SecuriteInfo.com.Trojan.Olock.1.17482.11374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d60d4b-12c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659487261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659487261, "uuid": "e7aa0184-1473-436e-8582-864ae7fcc6d1", "comment": "Malware payload (Loki)", "value": "123cea2154aba3d9e758698a046228e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659487261, "uuid": "6c680f0a-2115-4d1a-bea1-86096206f5ec", "comment": "Malware payload (Loki)", "value": "f0ec6836e0ffd8a1d57da428180b84adbb8844a2afbc5b5ed80f24d8e756b209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659487261, "uuid": "fc8507c6-0cb7-4537-9baf-44b6cb412899", "comment": "Malware payload (Loki)", "value": "751ab0a42dbab16d3cd81dfa20bc6f4e6cf3be50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659487261, "uuid": "f8c4d973-7c87-4e7c-be1b-1cbe1cf817dc", "comment": "Malware payload (Loki)", "value": "742735cebb322dd2d0bb65f610086e77fd74d16d546466eece8686b928572604a69cc04a9ad65f8eabeeffaf68fc309f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659487261, "uuid": "b990a9ad-7ec5-4470-9c19-345a47cdfa0a", "value": "T1E385BEC0B6941818E95F4F7550325D38413BBF2B7DADE3CDE809B1666EB33C25922A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659487261, "uuid": "5bc8fa38-cab2-48a1-b24e-9bfe48bb3640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659487261, "uuid": "db2f8346-116b-4536-a200-7488590ff77f", "value": "24576:g5FqzRxTPXvQyNzqI6DaZRRHquykxWw+/4t+:dNhqjqRwjp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659487261, "uuid": "e349be14-cd0c-4c75-9873-2ceaadc38180", "value": 1810432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659487261, "uuid": "2f42888e-9ec7-472b-b240-e499df62b03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659487261, "uuid": "540ec5bc-88f7-4125-8fa8-dcaa5d290887", "value": "Orden de contizacion.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc2a25b-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537931, "uuid": "ca863b28-d819-4ead-a5a5-b1ec9484440a", "comment": "Malware payload (SnakeKeylogger)", "value": "061c2fd08bc1441d8846af504b70846b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537931, "uuid": "8c458f17-5522-4741-83fd-b14865914ba0", "comment": "Malware payload (SnakeKeylogger)", "value": "f1cd4a3a0b9553811ce0127a7171d56a59929eef677c66d63d520b7177804e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537931, "uuid": "f5305d42-1e1c-4116-9d32-9552c258e024", "comment": "Malware payload (SnakeKeylogger)", "value": "31d4978525f0c74ab92e27290ac8b7db86624f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537931, "uuid": "eddbaa38-0d3e-4275-ac75-ce14cfcabf24", "comment": "Malware payload (SnakeKeylogger)", "value": "90a14187063f612d3482ff75e08d81bdaf6ff8469a12a9ecbaaf95d71112827d9fe059d90051cc6bc094d0b4b8a7735c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537931, "uuid": "4263ca33-f4d0-4c91-88da-4ba46ae3a4fb", "value": "T19E54F12444ECE477EBED1236DC382A0082264E3B6716E7D587F1F7960AC43658DF6CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537931, "uuid": "de6da547-13c7-4e54-b4f3-a65c3407b0fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537931, "uuid": "e0c779b6-8531-4df8-a6e5-1e0e9703ba13", "value": "6144:cY9lSSxmJpas8FimEB5SjHiSbS4D3nQBLAbS2Mg4kjqqE:cqSSSQsfmqwHiSOjBL32Mgqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537931, "uuid": "11985a38-0f29-49d1-9815-672b2d889138", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537931, "uuid": "a0d38eb9-8a56-4524-a229-5e6503cff622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537931, "uuid": "005471ac-6016-4fe1-b880-aa2de1a2295a", "value": "confirmations list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548246c5-1323-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659527798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527798, "uuid": "b2454abd-0775-468f-9266-d5ae2aac041d", "comment": "Malware payload", "value": "0ba0bd3e07bd7b620b2a6064c545f6c8", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527798, "uuid": "dbe28cea-f5e9-4d61-8291-72435cfe967e", "comment": "Malware payload", "value": "f1f34d768940b89e1619ccdd457f4a8f543bc06eb0afa3ce98aece060834c3d3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527798, "uuid": "66895300-dc37-4f73-b096-234900964f24", "comment": "Malware payload", "value": "d279863b0377e979e77c61bb98f05c3607d3dbca", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659527798, "uuid": "69b59203-5cb9-4d1e-87f0-2e9f5348896b", "comment": "Malware payload", "value": "90c5c48d0b53af5a37104f6896d9545096570ea90bb11fa0d02117e99adaf34d56f3c3f70e3bced4b480a61c903dff49", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527798, "uuid": "c14faa87-0de7-4b86-b496-921b78b24fa9", "value": "T1D4D2D00D595FADDEC86F7C3EAC2C0EE48E580141960178AD6D15FA7C2B46BC2434F6DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527798, "uuid": "ff9f31f8-96a8-4e5e-a10c-e9e1821cdcbc", "value": "768:Y1/KWuHsyS5JgCF0eczcoJ1mQG0LfT/5SawEI6g:YBsHS5iCGFzLLd3I6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659527798, "uuid": "04cfe9d1-73c9-40ac-b7cc-40a17892c206", "value": 30060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659527798, "uuid": "84968f7f-ae22-4bc9-8323-854bb2001690", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659527798, "uuid": "078d473b-0221-4de5-b4f2-80a3ec6e00f0", "value": "1_202208349440447534.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a78317d-130e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659518788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518788, "uuid": "11e8fcc6-edb1-4637-b485-0da02c86506f", "comment": "Malware payload", "value": "eae2fa763b7c00ca4b7d5f57c5d3ea0d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518788, "uuid": "7fe34e6b-215d-4d0c-bc78-86243dc362ec", "comment": "Malware payload", "value": "f25609f396644e4593527a1d550ba0c1626926df6c619929e2766fd3c2b72ebf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518788, "uuid": "3ad8aa61-8f56-48ac-872a-73982292b9c1", "comment": "Malware payload", "value": "02e8ed97768da626339c5a5b849c0fa900b9668e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659518788, "uuid": "ec242adc-335c-474f-b147-fc99859bab13", "comment": "Malware payload", "value": "63cde4ad06eeb7cdebcf5f0ffc13aa254211332064ed041f9f4e27b048c431bdc3db8ce321430cf94727fd7414da0672", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518788, "uuid": "ab2a99ce-7a4e-4a5e-b0c2-944e47321796", "value": "T172D2D09CD216B64DDDEF98BDF80C4DFA4828628285012C4C3E95E5783B612D4735F6EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518788, "uuid": "4476de44-b544-4728-9b1b-459eb9785ae2", "value": "768:Yb0KWuHsyS5JgCF0eczcoJ1m9ZGZ2HUYDe6NjMH8G:YbmsHS5iCGF6GdUAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659518788, "uuid": "8caa9d96-814a-4444-bd68-d77c4ad8f9d2", "value": 30020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659518788, "uuid": "fba6c9ae-b958-4938-8dec-9dccce7f6183", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659518788, "uuid": "8e1d06a6-9498-4a37-b182-0c6ec0886529", "value": "9_202208511985921120.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d998b6-12f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Metasploit)", "timestamp": 1659507726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507726, "uuid": "b15ac0b3-f5fe-40dd-8c2b-d2f9d77bfa92", "comment": "Malware payload (Metasploit)", "value": "ad178335b7683df465a50a84b3d7abcd", "object_relation": "md5", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507726, "uuid": "dc7a2235-ca8d-45f3-b1dd-b801de8dd898", "comment": "Malware payload (Metasploit)", "value": "f2da662ff21c7f7e6e77d7e8185092a398d53ce27550de646dc7ec474407379a", "object_relation": "sha256", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507726, "uuid": "caed492c-0d7f-4792-9532-ae278f8117ea", "comment": "Malware payload (Metasploit)", "value": "8aceb0c04ad7ca72ef651f610f0163b21a3f228d", "object_relation": "sha1", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659507726, "uuid": "090785ce-e6bb-4f74-bb5c-d6f6973a6040", "comment": "Malware payload (Metasploit)", "value": "26efa9c3b6739f7387430c515bbc4f8bdeb61929815ae584b5bc0f583d47c0704a0ee4e1428a064e3e69e1b7e096e333", "object_relation": "sha3-384", "Tag": [ { "name": "78-85-17-88", "colour": "#AFF8A0", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507726, "uuid": "5ba0db21-5ce4-4f1f-a37b-9e21b9f2682c", "value": "T16AD2F15984FD9667EB6CB5FEA07C8BC7C7496160EF01618EA760812E601321E43ED5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507726, "uuid": "52e20805-3711-4072-93c8-afc07a78c1c9", "value": "768:mYV+EGbvE+iBF5tIKmaCUWWllB50d4uGS3Z6wo:XVR+4B7v70OJSYwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659507726, "uuid": "93207c23-465c-479e-bc17-8b04b2ea7963", "value": 30609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659507726, "uuid": "25929f71-4717-4fde-a86c-030e7c47e004", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659507726, "uuid": "591959dc-11cb-4d99-bedb-2e26e5c18c38", "value": "cobalt_EvilClippy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26e9bee-133d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659539095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539095, "uuid": "21c614c3-8592-403c-ba62-abc66eaf292f", "comment": "Malware payload (Formbook)", "value": "90b28bcbc65841876e3d6c0404ad28cf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539095, "uuid": "55d16b00-fe14-4814-a825-beff0174d49d", "comment": "Malware payload (Formbook)", "value": "f3aeadc03dd30c9e13122f23e288088b0dc458a01460ecce61a435896e317afd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539095, "uuid": "138f6ba1-050d-49fd-a85b-4949d421c4cf", "comment": "Malware payload (Formbook)", "value": "986edf51c91e979f7ce8ed517af4b3cbb441f6c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539095, "uuid": "707a1a5b-92ae-41d3-879e-541ce970892a", "comment": "Malware payload (Formbook)", "value": "f5d628d2d32259daf7589ead17982b8b7575e05dd85048689aeb99f2b413c977e939188e5478be59bafd758c04ae342b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539095, "uuid": "86e46511-2e50-4b99-82cd-cfb0b82a2d11", "value": "T1EBE27C8F76946232E7568AF038B58FCC811D6F18B855494D2BF0FD4A6B7CF4904D92B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539095, "uuid": "a08754c7-5a33-4aa7-8186-837a18db7229", "value": "768:mNKxg+KgVbQE+PGG9+meUaFUEvbjfmw9K:m0grgVbQ37mLvPfhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539095, "uuid": "e779a27f-c3e5-4ca4-8305-d8384bafdccf", "value": 32952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539095, "uuid": "247cef6f-ae40-4a93-abf2-46274fb3c5fa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539095, "uuid": "dbc4fa2e-44df-4555-b033-715ed429306d", "value": "FNBQ96684 QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01441d2-12ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Pony)", "timestamp": 1659505242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659505242, "uuid": "8b857860-31ae-49cf-8622-cab1f70fbca1", "comment": "Malware payload (Pony)", "value": "03eddea44ef90106f4b5de326a68fdfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659505242, "uuid": "65e5615a-71a4-4c4a-8822-88f374eb1371", "comment": "Malware payload (Pony)", "value": "f3b4e23cb3c053523b8bac396a1ffda16843be201235bb55f07248bd4f91808c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659505242, "uuid": "3a3fa500-5f8d-4e94-bce2-7657cd6d8d8e", "comment": "Malware payload (Pony)", "value": "1d5c9ce05f01c43157a7dd50d8d571772ff8cb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659505242, "uuid": "755f91c0-b017-4bd2-9ab4-1ad37fc3fd46", "comment": "Malware payload (Pony)", "value": "b6d4cc4d4071e58cf4a4aa26a774dbf11bdef547b12faa9d8fca748ecf445a076afc24987271e053d1563bb8ab0ee9f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659505242, "uuid": "c576a695-1116-40aa-9a33-75682a1e2ffb", "value": "T1E4F2E1DF71801E67CB42A93AD98540D06D9490324DC1C7871D78B9FBF66EAAE392D13C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659505242, "uuid": "521577d5-5682-456d-9fe8-d1a6ef1aec68", "value": "df73209c8e0304ba710921b67130b1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659505242, "uuid": "00bff59b-d428-4587-a553-f0d6118e5469", "value": "768:jeAxCrJx6mRGq7M2jNdM45MYUjxtvDr1SMr/OBhXOWb:jrSTRGcM2jNdM4yZjxtvDoBb+Wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659505242, "uuid": "e6f5550a-2de7-4ade-a668-73332ced6dab", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659505242, "uuid": "4fb2c62e-5046-4056-bbed-875a0e55294e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659505242, "uuid": "8d89cabb-4e2c-4c4f-af68-9247d82c5545", "value": "03eddea44ef90106f4b5de326a68fdfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100be2a2-1373-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659562042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562042, "uuid": "7b3d8ff1-66ee-4873-ac46-177ed6b794f7", "comment": "Malware payload", "value": "9e396865d1a300d6c9fb30c2221bcc9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562042, "uuid": "3472d912-8c92-45e4-936c-975dde341601", "comment": "Malware payload", "value": "f3cfad9edcce3d47518751c931b95b68f510a80ffca4c0e11611ad5990c4f56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562042, "uuid": "b500019f-9c41-4a8f-824b-012f61439aab", "comment": "Malware payload", "value": "8494ba00004979c485e84010f4c0069faf195033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659562042, "uuid": "13e6789e-cf80-441e-845d-7e4664a047bc", "comment": "Malware payload", "value": "9fac4ba8df498b8eec42d8038f1e57364210a9595808d04e4ad6c83444a135c66f27e09e3ed51292633a788c821ad6e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562042, "uuid": "c15e9e0b-10f9-4b43-80ba-ffbf4e3dcb22", "value": "T1D9F4E0815367AF37F43937B3B15090586BB1502D91D2E2299AECB8EE2AB57130DF4B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562042, "uuid": "39f849f5-927d-4871-963a-0d42d097997d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562042, "uuid": "352c0a35-1cdc-438c-a4fb-e246f8b1e3ac", "value": "12288:GlU1Ogg6SKlpxr2iN8bEh5e6rbmUSjsmVzXsE4M8VWDLMFQYcn:wSLlpxr1+E7HuzjsmzXsE4VWv2dcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659562042, "uuid": "c18e2f25-1b7f-479c-9f76-e24e3c8581c6", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659562042, "uuid": "c32f7373-751c-4a6a-8c41-b3117c560dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659562042, "uuid": "edbc5bf1-3ba3-4eb0-8d2f-989a4a5a82c5", "value": "OKJ4pcIJQnHYYFW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38193bb-1305-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1659515153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515153, "uuid": "cd975669-2d38-497c-8fa1-ceae8164429c", "comment": "Malware payload (NetWire)", "value": "f77b620842bd1cbaf61adb1b85c6c31b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515153, "uuid": "1511781f-0091-4204-b5b2-d1db9f395815", "comment": "Malware payload (NetWire)", "value": "f44f6fbfc891bec5aaece28be3e010289e8c067389863110a9ea493c175a342e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515153, "uuid": "488e3053-7222-4476-b48e-954277c198ac", "comment": "Malware payload (NetWire)", "value": "da42cdb3d86820ff266984d8f45aa21e834f9f53", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659515153, "uuid": "2afe4684-4685-4540-a3f6-8706e7a9153b", "comment": "Malware payload (NetWire)", "value": "b119d428d72709b70d76dfa739f68f662ceee1fe91287399d6ff61e1ee4123a0acb9ec72ab65c2763ea7e76b522ee672", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515153, "uuid": "70d1374c-b19a-4ede-bcd9-33f3b2f8d2f9", "value": "T1B41533CB42A63D22DADF6D72E8B2524CF453D7F18E7E9801C0EEDB821954DAD490CB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515153, "uuid": "91265933-0fca-45ef-9dd0-e4ea2c90a248", "value": "12288:PSNPKCyalo5qfZQSPo77Qw62fGceq9u7gr71IzlsEfpl69uUDatR2OrU:aNvuUfZ+7QwXuP8Ogm5LEyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659515153, "uuid": "3c854c4f-aea4-41f3-92e8-160feb99bead", "value": 898444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659515153, "uuid": "3e18f00c-fc40-4bcd-b84b-0b55ab506625", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659515153, "uuid": "3b2d39c9-cc34-46d9-b455-deecd1b335e9", "value": "SV38848934334.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbaf27a-1302-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659513643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513643, "uuid": "14696910-f43d-4176-ae37-1b9cdfb6d479", "comment": "Malware payload (RedLineStealer)", "value": "fb680ffaa348368c8459da7fa99e2c5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513643, "uuid": "f4177c9b-9315-4c66-a0b8-b3f55d2ac91b", "comment": "Malware payload (RedLineStealer)", "value": "f508a5479500c79e872f12127ef1ff1cb0058fd6b15c91f6448d0d445621aea3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513643, "uuid": "bd8c175c-ebeb-4958-b99c-48b245564f37", "comment": "Malware payload (RedLineStealer)", "value": "047da6c9c85c42284f5d8f5079b574abe92ad99d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659513643, "uuid": "daccbe63-894a-4657-8f60-4fbb6c8d1996", "comment": "Malware payload (RedLineStealer)", "value": "518a379dcd8c3b4b1cc8665e992dadf3d460fe52469ffd3cfad27e98658e6ae211efa9ec2b2870194d1c26665bb4be46", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513643, "uuid": "9dbefc34-f52e-410c-a271-326ab44528e0", "value": "T1EB02D88C3864F6CCC62D952962782DD5E7F87A5FA0011B8B753C31886FB2524D6E9C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513643, "uuid": "7e668477-9409-4d5f-b26f-87057984cd30", "value": "192:FHkSKRO6vCuXegQ8g6wpiz+Z6KaokjJ8nT2Lm7PKJ96h6V6wFWtKo4vSxRf4:FHkSwO6xaSLm7PLQ3UAo4vSng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659513643, "uuid": "afb0173a-3af0-437c-90f7-28d7744eadfc", "value": 9011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659513643, "uuid": "719ce19b-e4fe-4295-8e9f-3061baebd2ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659513643, "uuid": "0732cb9a-5fd5-48ad-aa4c-35f165f2c6e8", "value": "Proforma Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afd1b24-136c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659559162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559162, "uuid": "72b20082-c3d5-46c5-b48c-c7ff9d41ddd9", "comment": "Malware payload", "value": "341a4bfab46a72534a20aa99692a79c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559162, "uuid": "83ef3898-bad4-40f8-b658-8319c2e2fbf0", "comment": "Malware payload", "value": "f62005c24558ce03fb1629a569acc44cfb8e983c7a9533f563e34bb29bfd8204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559162, "uuid": "d8cf67bc-fb43-4fe9-9eb3-bd79722d30ea", "comment": "Malware payload", "value": "50a2844361662869267cca0a2d6228328041dde2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659559162, "uuid": "85a89ebf-0884-48e6-ac05-7bab4569a3ef", "comment": "Malware payload", "value": "d8422c772418456e7150939aaa44e022b83482496f092694a660099443292bb04271aee548d01e71d1ba1ddf38615e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559162, "uuid": "411e6728-0bd7-4e7c-b133-2cfaa585389f", "value": "T1B3F49D1022D5AB28E03A57745AE0D03047F6FD16D639D66D7DD83ECBBB32E408A62763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559162, "uuid": "6594fcc9-d03f-4b4f-88db-66232fd2d1cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559162, "uuid": "08e0eed0-8127-4453-b225-d7f071bbfadd", "value": "12288:PxzN1HMphuD7uWiDUy1TCICTrwqzYg+cYzo9K366C:pIUrhPwqzjYk9AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659559162, "uuid": "337edef0-e66d-4f90-a5c4-c4193e270662", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659559162, "uuid": "a29d9310-7d79-4254-adbf-355db98b6c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659559162, "uuid": "de8f4579-7f20-42f3-94ae-497325388570", "value": "Statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdc8205-1319-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659523488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523488, "uuid": "aa508585-a053-4b94-b926-47c660507927", "comment": "Malware payload", "value": "825bafb867a17118bb2cac318a145273", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523488, "uuid": "b0e3448b-ccb2-494a-8f9e-f96e416ec08d", "comment": "Malware payload", "value": "f6579ecb2d6b796ec9f35687b2dfea0afe8f1a3be3ef5b51ca9f7934d428a315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523488, "uuid": "e3c28316-afbb-4655-a198-0b121ce9bdac", "comment": "Malware payload", "value": "cd171faeb92ba91b2f6a2d34408014453a29c412", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659523488, "uuid": "6068ac35-8750-4bce-9b89-f4cff633c0a8", "comment": "Malware payload", "value": "5dafbf70428fc7de6b82e1b41b0f18f0ffe7cd1a10b70ec184e5f6479fd59766fbf3b40affc4458639ec20a984c1501a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523488, "uuid": "bcb80e31-2fe1-437a-a4f3-df31f9b3ecc2", "value": "T1AA84968B3D10E5F5C83C6839E6D1B214037F2EB457863B01FDA9B2A63AF66443B4656C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523488, "uuid": "90c0bb9a-9741-4991-8d86-f3f639931882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523488, "uuid": "3048da56-859d-4e93-86c7-aa0cf6316418", "value": "1536:XvecIyeiJ5hkRI7c+tMHNDHQTOqsW2wo+iz2XiaNZsrz:XvecIypJ5ntMHOSbrzmiaNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659523488, "uuid": "827900c9-fa36-448d-bbc9-5480c8ccb806", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659523488, "uuid": "125c0213-1397-4310-9804-fc4c835b5252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659523488, "uuid": "e9c5dd92-4eba-4a54-89b3-e3c97d43a00e", "value": "825bafb867a17118bb2cac318a145273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8ca1b6-1303-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1659514064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514064, "uuid": "5f5f0da1-08f2-48d2-8f7f-ded33e468ec7", "comment": "Malware payload (Formbook)", "value": "a6adb58f208e73b1212f59886c87e1c7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514064, "uuid": "14ccc080-cb1f-4e98-a12e-f2dded7d37a0", "comment": "Malware payload (Formbook)", "value": "f72b6eb053f427e2793bd12ab6bae781f2eb868561cc547dc0a17aa9fb32b5a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514064, "uuid": "390266b3-2f93-4354-8397-f9a31b2ab41c", "comment": "Malware payload (Formbook)", "value": "d4a8ac24051df88ce93c8e9b8a516d2cf4143ab5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659514064, "uuid": "db3bb2af-de9b-4d05-ae3f-b71a16a74378", "comment": "Malware payload (Formbook)", "value": "0f7719c55583766cb63d5b9314ec5f70508f740cf0f0b4a75ea539187beacfec7f4417819af7eb55ab84b26b7416b07f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514064, "uuid": "84c196c3-c128-4523-a0a4-27ae0c07c1bb", "value": "T198A423AAD7CB02E2D0E8B67D9335242706DC275349AED662183AD919CDF518FC01ECCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514064, "uuid": "f362a456-19ea-478e-bc7c-4034f8fb6881", "value": "12288:20cdNXSRhCkhj62xZ0tbYjQYad1Smt8Cf:YfXS2u22/QYa3SU8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659514064, "uuid": "b3f5d715-751e-48fc-9b08-0bc4b167c27f", "value": 478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659514064, "uuid": "05dcf468-f906-4192-8a89-695145e5434c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659514064, "uuid": "76bb1116-1329-4a2f-bdc8-99f3bda95003", "value": "Glxfra.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03d0d0f-1355-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659549453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549453, "uuid": "24b66274-a7e5-453b-8a61-c8e2e19ba79f", "comment": "Malware payload", "value": "6c944a11f6e93a6d7222fad7acff0da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549453, "uuid": "7fea0954-9366-4b24-a352-a4665aa09c21", "comment": "Malware payload", "value": "f7e374a58c6cf08108d81efc4253a1d724f04bd2e9f1d2dfba7879a2178a0d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549453, "uuid": "8cf71b8d-80ea-4fc3-845e-2b6d7af2b6b7", "comment": "Malware payload", "value": "7b0616b84383ee0e06cb3b531cec905e68b2e6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659549453, "uuid": "8b665d1e-1f65-4c19-aa7d-95dd4708935f", "comment": "Malware payload", "value": "08e50e80f3f805477babdc76c827dcd591a8b55a25105ba12286125503c4307299517ab4f73095741212ca58f8149e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549453, "uuid": "34e16056-7b6e-455d-82ba-451fed634e17", "value": "T174535B24E782E5E3D46951398691B8D66232BE159FCDCFCF8B607FD20463A25EF09B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549453, "uuid": "b2dc4478-088e-4dd8-aa93-640e85a0617c", "value": "7c773e532aaf19a45d9dc6db063d0df0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549453, "uuid": "fb35bbe8-8610-4698-9496-a96633f610b7", "value": "1536:0RKGpYwSMaTbQ01XUGYN0Jf1XppxcPswfUnrzzD0ezZmM4R:zGRSMeQ0idNA9XxcUi6rzP0eoM4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659549453, "uuid": "ae5fdcbe-f3bd-40aa-b5e5-98a869ed1631", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659549453, "uuid": "18c5e8bd-ee9c-4e72-9cd8-64d17d0913c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659549453, "uuid": "7cc21470-412d-49d5-9c38-e5d0a0bd7bca", "value": "IIntoAndEvenHow.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28ed520-133a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659537941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537941, "uuid": "35fa9474-6c6a-49b2-bbcb-ef84ad5f6e2a", "comment": "Malware payload (SnakeKeylogger)", "value": "057e860dc6c39e1375e988d35cff5fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537941, "uuid": "a6adc8bc-a5b4-417e-b04e-2e8e113e4602", "comment": "Malware payload (SnakeKeylogger)", "value": "f83b7a61eb6df4c5c13e442fcce7d5dda2cf0c0d1a6206ed101fd2ecc96adc7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537941, "uuid": "38a5add9-bd39-406a-98b1-a9c3ddb72c4e", "comment": "Malware payload (SnakeKeylogger)", "value": "45cbc20f6874d218f165e0ecb1395318b3b655b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659537941, "uuid": "f938dbf6-1b1d-41f5-8599-aa63c4204441", "comment": "Malware payload (SnakeKeylogger)", "value": "a4f793970a4a792580f1ba126b7ce6aea2726de5992a104541e59e051f95ebd6ee08b03df723c345a598bf40a95113dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537941, "uuid": "d4d504c8-e531-4040-a416-51e7fda846f0", "value": "T19B340238C8EC9D67DAFE2A312C35BA148357693B6B06F3D45306F412048733AD4B9DA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537941, "uuid": "c6ca085f-5063-4f6a-a771-bc6bd9259420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537941, "uuid": "e01993ea-788a-4cde-b3d0-27a2592ccee0", "value": "6144:bY9lSSxmJpvs8ljTO9rnNnY9eSewrlRCfscujK2dySUsf:bqSSStsqjDeSxrCfsjHAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659537941, "uuid": "15e2b089-06f5-4950-8e4a-59e2220106b3", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659537941, "uuid": "e5a454f7-7c51-4560-a2da-94e9e123229f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659537941, "uuid": "004cf33b-3168-4aed-aefb-aa55feff05cd", "value": "KH-300454 0002R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb91322-1368-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659557420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557420, "uuid": "49a4105c-cb48-4942-8502-951140882d79", "comment": "Malware payload (ArkeiStealer)", "value": "4e283b4ac812241b47616aef316deb4c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557420, "uuid": "391ed69e-c2d0-4d97-8a73-17b7483fd415", "comment": "Malware payload (ArkeiStealer)", "value": "f855a9c82cd4ed9daed1a6cc0cdb66d4dd41abdfc546e1775d20a8db2d3ca4f1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557420, "uuid": "f2ffbabf-8553-4d14-8e14-3aeeb1a0015c", "comment": "Malware payload (ArkeiStealer)", "value": "8f42f0160b8d38cbef0a8d141f48063ea7e37a84", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659557420, "uuid": "53bf57d9-99b0-4643-a359-a47fdfb7838e", "comment": "Malware payload (ArkeiStealer)", "value": "d55d453b3d57d9b5950704332ee75fb994f276be5f73b0b500f1660b3e88cfedc6961a3e4607b28c826e99002cd73650", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557420, "uuid": "240055fb-a9b5-402f-9e61-ff8f6a8b0e67", "value": "T15C04BD2033E0C072D5A769305876C6A06A7AFD222BB499CB37E4173E1E71FC19A39757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557420, "uuid": "37c2226f-0564-4034-a1b8-3fdae385423a", "value": "ba3d499d4d95678ffdd9252ddd2d1d74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557420, "uuid": "4b0e03d2-88bb-4f2f-b7ed-1256277d9a1b", "value": "3072:ZHRWQhKkZNwoprNNgj4F/3tnrDpUV+DnMIcJUObI4Y:ZZFZaoro4F/d/E+DeJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659557420, "uuid": "b89f0fb8-3ed7-4562-b3ac-4a480f192ce4", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659557420, "uuid": "abfb359b-0ee3-4d45-89f0-5c24f41f2a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659557420, "uuid": "c885a9e2-851f-4826-9e58-3e4e269172c8", "value": "4e283b4ac812241b47616aef316deb4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca710de-1329-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659530469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530469, "uuid": "4ae5810a-a358-4242-8d21-c940f2bdac89", "comment": "Malware payload (RemcosRAT)", "value": "5594e0ca7eaa0ae566ff83214c547e78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530469, "uuid": "b1c19165-2026-462c-8949-060ad5caf7d2", "comment": "Malware payload (RemcosRAT)", "value": "f87d3d53935db06707f2303dee46335a41419ca6cb6e599cf03eed703a85f194", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530469, "uuid": "0dd6e814-4251-4be8-8f58-9f0ff62cb5c9", "comment": "Malware payload (RemcosRAT)", "value": "50b33de91d3a16b6eab91380a941ef852f7e36f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659530469, "uuid": "d5b5b92f-7eab-4d46-9ef4-5b9943569c8b", "comment": "Malware payload (RemcosRAT)", "value": "ccfea62db99acd2359bd27430d2325e2e4e013fd3f7551b1fdcec1bcd4439af6f947ba225c80c8e5ec37162b5fe0e9d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530469, "uuid": "7bd7e343-9462-4bf3-a305-dfa4f6e05556", "value": "T17CA4BF11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530469, "uuid": "2768147d-6ffd-433a-81e4-43ecbc52eba7", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530469, "uuid": "1ee5d48b-05bc-4c35-8281-91331385755c", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUHzEyg:hOFtiNBuFgawDB4NOmuwsfZPXyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659530469, "uuid": "12dab9d2-84ca-4d42-8966-b84f4f4fc027", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659530469, "uuid": "38503f62-57d5-461c-b101-08d4da2802f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659530469, "uuid": "ec4a7c63-7f82-4033-9bbc-91096894aa7c", "value": "5594e0ca7eaa0ae566ff83214c547e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aab1c3f-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1659539377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539377, "uuid": "da53874c-3944-4f92-96be-feb07c5ac962", "comment": "Malware payload (GuLoader)", "value": "583106fb1bf4d031a5e837252a248c10", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539377, "uuid": "bfcb94ed-c7a2-4b1d-8319-e40da652779b", "comment": "Malware payload (GuLoader)", "value": "fa04f3008b2fed32f089365b0cd0c96ddc103cdc42443b5eeb9c7ffe596e11d2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539377, "uuid": "1d95dac6-bd61-4e30-b4e4-e70bc045c9ce", "comment": "Malware payload (GuLoader)", "value": "b94f26122762902dbac119e93651e6f3fc306b9d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539377, "uuid": "93637de5-44d5-4330-aa50-5d390649cf0d", "comment": "Malware payload (GuLoader)", "value": "623ff6602143ca575cf6000f76696479c86c6804bd4976d302e330702aa28572cd6dde18ec4d33615fa5d09554027b9d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539377, "uuid": "790c1f9f-2336-43ff-9b66-1f8ebde3166b", "value": "T1ED640159BE80C6F2CB680A718C77D6BB17736C231554765B8B00F77E2E732A3E50AA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539377, "uuid": "812aaed4-a8a0-49b2-9eef-234674ef4e65", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539377, "uuid": "3df439a2-bb91-45c8-84b3-156b01d3f3ee", "value": "6144:WNeZOqwv/6/tv1TtGRfI362sLFaFp1Pw/axw5O02R:WN1qwv/6/rwRxJFaFp2PO0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539377, "uuid": "135b493b-f4b5-45f4-bc43-a3131bf513b0", "value": 320896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539377, "uuid": "da77cedb-dda3-466d-b099-9f02aff21209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539377, "uuid": "11a8742d-474d-4400-844d-ffc4444bde22", "value": "Al\u0131nd\u0131 DHL_119040,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2942eab3-1346-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659542757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542757, "uuid": "de2f6cbf-f70f-4904-a204-63b1cfcd1f27", "comment": "Malware payload (Mirai)", "value": "b4239bb1d2a994acc41d88c5c1aa1442", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542757, "uuid": "bdff4bf8-bcd7-4a7d-9731-9185e45cb1a5", "comment": "Malware payload (Mirai)", "value": "fbcec9f36ed3f1216f324751bf0ca7fbdb3748d5338051388c1d45ebaf2fa338", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542757, "uuid": "9f8fd8c1-6858-4189-9fa6-051419c7dad8", "comment": "Malware payload (Mirai)", "value": "e21a65eaf7d5bc0fd458608aefeaa7b4ce45ec25", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659542757, "uuid": "57e7f8d3-f260-46e1-b4fe-4be947bae4b5", "comment": "Malware payload (Mirai)", "value": "459956fe5ce7881f8d9b1fddf658aceb1b2e795f36a1ff68d69265932c04b956a15bfd196eeb59b5010a7fd3ed0ba299", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542757, "uuid": "8303d83d-6f62-4646-8a81-489f8370b0ee", "value": "T16DA2E0A9FFA1C089E0C6453C19E379AB766BDDE383A8436B6D91D9C519D38CC805EC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542757, "uuid": "04077143-988d-4b0b-960b-b61c1df404f9", "value": "384:pDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chQO1Hfmmcb4/N7KbxTKqB1cuiFqcJT:pDZ5Dw7RjFjcU+O24sDO1uE/Nmbx+qrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659542757, "uuid": "8794aa83-83d0-4953-be90-b6558a35734c", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659542757, "uuid": "18f018d3-ea54-4d67-a21e-2e0c820fa02d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659542757, "uuid": "aed9f835-19a7-4bcc-a72a-7f622812293f", "value": "b4239bb1d2a994acc41d88c5c1aa1442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8613a4b-133e-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1659539562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539562, "uuid": "ac9e200c-2eb4-4076-b373-ef33904550bc", "comment": "Malware payload (NetWire)", "value": "afcf21a9379f301577b6156e7dd5888f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539562, "uuid": "f94277d1-7702-4542-acf9-52bff086a553", "comment": "Malware payload (NetWire)", "value": "fbd12a584f6a7db50d27d2e9eeb3ce160f84142049d75b2044411a589eaaf4d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539562, "uuid": "cb44e0a5-c12f-4d20-932f-9dd8230dc575", "comment": "Malware payload (NetWire)", "value": "ce875060f396eb0699cdd5d11d7e871ea6e72c0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659539562, "uuid": "2b01ff4f-9322-4c32-89e3-ff0a7d3bb890", "comment": "Malware payload (NetWire)", "value": "453be19d709d64d059e5fe3195916c7e5063372a1b1ffc8ed95ca972b76950d46d4dcbc053b6d6f18c43102999121b60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539562, "uuid": "1142bfaa-d945-428a-aedc-7eb245180fdc", "value": "T17E945B229B40BB9DE2946D5FE07D0A5E21F31B44C4A2B3CD6363B50B66FDD0C6B2961C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539562, "uuid": "0f431cfb-1cb7-4898-8e13-efe388a1e5cb", "value": "6144:kMZCErheDvi8IgxStj0keI+zawqXM60uBP5l3m1+ilO/VjXAh+1u2:kS/exStj0ppzaY60OP/fX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659539562, "uuid": "b4a1a479-c441-4a00-ba06-3e6710e3ed6f", "value": 421311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659539562, "uuid": "f8489b6c-e0bc-42f8-92f4-fc6ab7298413", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659539562, "uuid": "273a7020-665f-4778-906f-cd41736feb42", "value": "Quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb990e81-132c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1659531836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531836, "uuid": "40d6e66a-3f98-413f-bd38-5651269b8e76", "comment": "Malware payload (RemcosRAT)", "value": "2a2ee40a729b9e1dcf30327a115b9652", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531836, "uuid": "447ccb64-e9ee-4f47-aeb4-3a917f7149d2", "comment": "Malware payload (RemcosRAT)", "value": "fcfa146252a5d7373b4d0c722541bcbef056e9aee2e07f5ba4d09939c3b660c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531836, "uuid": "b1e7752e-c40a-4cc5-825c-b31f79a0ca37", "comment": "Malware payload (RemcosRAT)", "value": "237c267bb7dbff058d1e890f59cf17425a27e51a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659531836, "uuid": "1323dc60-ecb2-466e-b336-66ff225d33be", "comment": "Malware payload (RemcosRAT)", "value": "92f8860c6442ba6c0e84b944c18796e34b5cb8df71c9debeadcf4611e4ead6839881b4853759643fd3656d2aa3f9c6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531836, "uuid": "04982f1d-6ca0-4957-98f8-20e95693b889", "value": "T15DA4BF11BAD2C072D97251340D29EB35DEBCBD202935867BB3D61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531836, "uuid": "f00c1549-d8c4-4d65-8e1d-586ba95649ec", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531836, "uuid": "fb7439b5-3e01-48da-80bd-c15cac790f4c", "value": "6144:pOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUD4yg:pOFtiNBuFgawDB4NOmuwsfZPryg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659531836, "uuid": "4c4c0c5e-8c3b-4a0c-8ec1-58a67d61358a", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659531836, "uuid": "2ab5ac97-a34c-4699-9816-517ab98ea9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659531836, "uuid": "e422aa39-07f7-4857-8f27-78b29d57c39d", "value": "2a2ee40a729b9e1dcf30327a115b9652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee0acdf-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659511843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511843, "uuid": "e16e3ea3-9fb2-4fe9-8293-e94b5d75b5ea", "comment": "Malware payload (AgentTesla)", "value": "8a48ef963f4df0b06cb372f21d47c1b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511843, "uuid": "65bacf57-892f-423e-97e6-20cff36a5671", "comment": "Malware payload (AgentTesla)", "value": "fd3ee92d2d58129a26dd3f43816178047afc35b7b423da06a6db32ea23ff6613", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511843, "uuid": "efb508cc-5b1f-4f08-a356-a6a6c14e0439", "comment": "Malware payload (AgentTesla)", "value": "f0aa0c1ccbba82cb21288157cac7134addb02bef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511843, "uuid": "bcd42299-b673-4003-8562-5ff2d9464f0e", "comment": "Malware payload (AgentTesla)", "value": "b15daf0dac1137487d79ad6472b414313d559b05f792e60e6c43d359a618f57053b9eb57107865089b6def23bfa0bc8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511843, "uuid": "e46866ed-c572-4abe-80e6-54de2e205f2e", "value": "T147C4D07046BE2C80F819CFB757BF8C5804373E34552D36CDDA8439EA907AAD92767982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511843, "uuid": "4da22829-a28e-4600-b4f4-a3742de494b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511843, "uuid": "7659b1d3-1f16-480a-9e65-6769d7fa41b0", "value": "12288:yVKivx8Kv8i+XWnGREI/bINghaIl+o1+kSZuOksFd71Fs4qQXvv:yV3vx58WGWI8N+aw+JZuDsFd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511843, "uuid": "db355c9d-f249-4f5b-82fa-176ebb64d3e0", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511843, "uuid": "850d30e1-9849-4d91-bd38-e7c01bfb360a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511843, "uuid": "9db00acd-6b4d-4162-8a09-1003baba89ff", "value": "ORDER-KKP-Signature Aluminium-1205-2022PK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777aa445-136a-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659558351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558351, "uuid": "11036a19-f246-437c-b7c4-2503bea2b431", "comment": "Malware payload (AgentTesla)", "value": "b963e93b16f53c5a707355289235ce14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558351, "uuid": "dd316eb4-9105-4273-b6c4-aed53e60842b", "comment": "Malware payload (AgentTesla)", "value": "fd6fd772c4ef80de1de94f904e4a3511c47858ab462746584cba6c89c1aaacff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558351, "uuid": "f100ae34-5b6a-4dbe-b2fa-19673105b9ac", "comment": "Malware payload (AgentTesla)", "value": "0e5e389436e0f7bf36459797918960ba47ac7305", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659558351, "uuid": "a0bf3fe8-d442-4ee4-919f-361ab2389a87", "comment": "Malware payload (AgentTesla)", "value": "f707b45dd3bb2e36689934e63319628375b999d2333da6d5fb692fb581e0b7ff7da05bf478d5aa7a01dd83d66bad2505", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558351, "uuid": "d76f571a-78af-407b-abea-a536fc1047b5", "value": "T1D0E48D1022E5AB58E03A5B745AE0D03047F6FD16D639E66D7DD83D8FBB32E408A52723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558351, "uuid": "1bc71bd4-b52e-48b4-ba84-e86732657ad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558351, "uuid": "cfc92667-e968-4b01-8a8a-69af98e7d00a", "value": "12288:cJg7Beb7lIux7uWirIT36zNugRjlCOf5XG4JbTho:wXJkIjWugPlLJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659558351, "uuid": "3386b0bc-453c-4572-ad0f-9e743b5fe5ac", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659558351, "uuid": "9bfcd157-6e29-489c-a848-c821b3e4f794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659558351, "uuid": "7af62d3e-ae2b-4673-8362-9819a360e2b3", "value": "Quote#20220803-83827.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1adeaed-132f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1659533081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533081, "uuid": "929b7b1e-0cbf-47fb-b527-b53cdaac998e", "comment": "Malware payload (Gozi)", "value": "7d8c4d9d225cd82c6ae5706503b698e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533081, "uuid": "d02c517d-e337-4d2c-989b-670b3d77aff1", "comment": "Malware payload (Gozi)", "value": "fe7ace13b5ead1e1d6614e74a2d2a470664218cb0f22f37fcaed1540349a7033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533081, "uuid": "63127b72-c91a-4a82-a314-a5ab25ca072e", "comment": "Malware payload (Gozi)", "value": "1dddc158b56e0025b36eae2c0932626f5caadfca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659533081, "uuid": "b359f357-4dc7-4df1-ba6f-ef75d01c4530", "comment": "Malware payload (Gozi)", "value": "a865a8c8e3531d47e4c8d567f4ee9d16a007d796800ffc68fd9785636bde36b6d0c82bc98495b22ce0cfb29627dec5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533081, "uuid": "340f78a6-683c-4a6c-944a-6415de3f90cb", "value": "T16F246D6AA3E51195E96BD5B5CE53D227E7F330092B24C31F53B4CAA66F47722B21C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533081, "uuid": "3b4d8ce5-c52e-4711-b707-ac91f1e23221", "value": "6144:SOZiNwkzdjpi5azwE2uP3qqMFTXAie58jwN:SHwkx9cazwE2Y3q9TXtKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659533081, "uuid": "bb8cd003-19b8-4489-b4d1-b5ccbbe6d4ee", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659533081, "uuid": "ad01a9e8-5212-41b4-9b91-694a63ce1d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659533081, "uuid": "ff5a066f-2e11-4eaa-a133-a4c5a6d0a068", "value": "eac0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3444d6-12fe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659511844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511844, "uuid": "df98abb7-dcc1-488b-81cc-25f11c573d4e", "comment": "Malware payload", "value": "b319871f791656ec0268a8ee5bacdc25", "object_relation": "md5", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511844, "uuid": "96c38916-110a-4671-9c61-e6704dc5d284", "comment": "Malware payload", "value": "ff4600c517b34b5d9c2cfa695122f5a9d1f78c84e8f9c3bb77d46d4b6691dd4b", "object_relation": "sha256", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511844, "uuid": "49aa0130-df48-4678-84c2-c35a3e46ced5", "comment": "Malware payload", "value": "20511ee67de7581f73a829284c736d6ae0ca6652", "object_relation": "sha1", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659511844, "uuid": "679f74e2-dccf-4cb4-a95d-13b40515fe22", "comment": "Malware payload", "value": "13585a04052ed9d3e57fbb52d241e5499dafbf19d42ea38f825c5c43ff3da49ac1ffad0251fbf631ee6f7b137dfc835a", "object_relation": "sha3-384", "Tag": [ { "name": "146-70-24-168", "colour": "#9B7FCA", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511844, "uuid": "1f8d5a07-4774-4cc4-a0bd-b8b4648a70a7", "value": "T14B548D347DC94CCDE58BFBFB81AB719A272CF72691CD5A11A4288D04C2085F6AF1725B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511844, "uuid": "7e456929-cba3-4dea-9ffd-ce1a5c75f57a", "value": "3072:PYxppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppo:PRmY1Ef0m9CW0MWodRrBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659511844, "uuid": "7b2b7ffa-670a-4dc0-b6cb-5c6689fb9abf", "value": 281749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659511844, "uuid": "d316804a-99ab-45e7-847a-9fc80613c005", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659511844, "uuid": "f0ad1c0b-90e4-4b30-a624-3d7d7533c846", "value": "1.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }